* [PATCH] time: Fix use-after-free in getdate
@ 2023-06-06 17:20 Arjun Shankar
2023-06-06 18:47 ` Adhemerval Zanella Netto
0 siblings, 1 reply; 3+ messages in thread
From: Arjun Shankar @ 2023-06-06 17:20 UTC (permalink / raw)
To: libc-alpha; +Cc: Arjun Shankar, Martin Coufal
getdate would free the buffer pointed to by the result of its call to
strptime, then reference the same buffer later on -- leading to a
use-after-free. This commit fixes that.
Reported-by: Martin Coufal <mcoufal@redhat.com>
---
time/getdate.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/time/getdate.c b/time/getdate.c
index 1dcbd77188..ca058394a3 100644
--- a/time/getdate.c
+++ b/time/getdate.c
@@ -114,6 +114,7 @@ __getdate_r (const char *string, struct tm *tp)
struct tm tm;
struct __stat64_t64 st;
bool mday_ok = false;
+ bool found = false;
datemsk = getenv ("DATEMSK");
if (datemsk == NULL || *datemsk == '\0')
@@ -181,7 +182,7 @@ __getdate_r (const char *string, struct tm *tp)
tp->tm_gmtoff = 0;
tp->tm_zone = NULL;
result = strptime (string, line, tp);
- if (result && *result == '\0')
+ if ((found = (result && *result == '\0')))
break;
}
while (!__feof_unlocked (fp));
@@ -201,7 +202,7 @@ __getdate_r (const char *string, struct tm *tp)
/* Close template file. */
fclose (fp);
- if (result == NULL || *result != '\0')
+ if (!found)
return 7;
/* Get current time. */
--
2.40.1
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] time: Fix use-after-free in getdate
2023-06-06 17:20 [PATCH] time: Fix use-after-free in getdate Arjun Shankar
@ 2023-06-06 18:47 ` Adhemerval Zanella Netto
2023-06-06 19:04 ` Andreas Schwab
0 siblings, 1 reply; 3+ messages in thread
From: Adhemerval Zanella Netto @ 2023-06-06 18:47 UTC (permalink / raw)
To: Arjun Shankar, libc-alpha; +Cc: Martin Coufal
On 06/06/23 14:20, Arjun Shankar via Libc-alpha wrote:
> getdate would free the buffer pointed to by the result of its call to
> strptime, then reference the same buffer later on -- leading to a
> use-after-free. This commit fixes that.
>
> Reported-by: Martin Coufal <mcoufal@redhat.com>
It seems to be introduced by 21f0b087ee10391433d8279e7c6f104fb9ea0eef, and
running time/tst-gettime on valgrind shows the issue.
LGTM, thanks.
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
> ---
> time/getdate.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/time/getdate.c b/time/getdate.c
> index 1dcbd77188..ca058394a3 100644
> --- a/time/getdate.c
> +++ b/time/getdate.c
> @@ -114,6 +114,7 @@ __getdate_r (const char *string, struct tm *tp)
> struct tm tm;
> struct __stat64_t64 st;
> bool mday_ok = false;
> + bool found = false;
>
> datemsk = getenv ("DATEMSK");
> if (datemsk == NULL || *datemsk == '\0')
> @@ -181,7 +182,7 @@ __getdate_r (const char *string, struct tm *tp)
> tp->tm_gmtoff = 0;
> tp->tm_zone = NULL;
> result = strptime (string, line, tp);
> - if (result && *result == '\0')
> + if ((found = (result && *result == '\0')))
> break;
> }
> while (!__feof_unlocked (fp));
> @@ -201,7 +202,7 @@ __getdate_r (const char *string, struct tm *tp)
> /* Close template file. */
> fclose (fp);
>
> - if (result == NULL || *result != '\0')
> + if (!found)
> return 7;
>
> /* Get current time. */
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] time: Fix use-after-free in getdate
2023-06-06 18:47 ` Adhemerval Zanella Netto
@ 2023-06-06 19:04 ` Andreas Schwab
0 siblings, 0 replies; 3+ messages in thread
From: Andreas Schwab @ 2023-06-06 19:04 UTC (permalink / raw)
To: Adhemerval Zanella Netto via Libc-alpha
Cc: Arjun Shankar, Adhemerval Zanella Netto, Martin Coufal
On Jun 06 2023, Adhemerval Zanella Netto via Libc-alpha wrote:
> It seems to be introduced by 21f0b087ee10391433d8279e7c6f104fb9ea0eef
It already existed before that, just not triggered for typical uses.
--
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510 2552 DF73 E780 A9DA AEC1
"And now for something completely different."
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-06-06 19:04 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-06-06 17:20 [PATCH] time: Fix use-after-free in getdate Arjun Shankar
2023-06-06 18:47 ` Adhemerval Zanella Netto
2023-06-06 19:04 ` Andreas Schwab
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).