Re: [PATCH v2 3/5] avoid -Wuse-after-free [BZ #26779]

[Carlos O'Donell <carlos@redhat.com>]

On 1/24/22 19:58, Martin Sebor via Libc-alpha wrote:
> On 1/24/22 17:52, Martin Sebor wrote:
>> This is a repost of the original patch but broken down by source
>> file and with some suppression done by #pragma GCC diagnostic
>> instead of conversion to intptr_t.  It also adds fixes for
>> the same problem in the test suite that I overlooked before.
> 
> The attached patch suppresses the -Wuse-after-free instance in
> io/ftw.c.
> 
>>
>> On 1/15/22 17:21, Martin Sebor wrote:
>>> GCC 12 features a couple of new warnings designed to detect uses
>>> of pointers made invalid by the pointees lifetimes having ended.
>>> Building Glibc with the enhanced GCC exposes a few such uses,
>>> mostly after successful calls to realloc.  The attached patch
>>> avoids the new warnings by converting the pointers to uintptr_t
>>> first and using the converted integers instead.
>>>
>>> The patch suppresses all instances of the warning at the strictest
>>> setting (-Wuse-after-free=3), which includes even uses in equality
>>> expressions.  The default setting approved for GCC 12 is
>>> -Wuse-after-free=2, which doesn't warn on such uses to accommodate
>>> the pointer-adjustment-after-realloc idiom.  At the default setting,
>>> the changes to ldconfig.c and setenv are not necessary.
>>>
>>> Martin
>>

OK for glibc 2.35, please push this commit.

Expected commit message (three lines)
~~~
io: Fix use-after-free in ftw [BZ #26779]

Reviewed-by: Carlos O'Donell <carlos@redhat.com>
~~~

Reviewed-by: Carlos O'Donell <carlos@redhat.com>

> diff --git a/io/ftw.c b/io/ftw.c
> index 2742541f36..08ccbdd523 100644
> --- a/io/ftw.c
> +++ b/io/ftw.c
> @@ -323,8 +323,8 @@ open_dir_stream (int *dfdp, struct ftw_data *data, struct dir_data *dirp)
>  	  buf[actsize++] = '\0';
>  
>  	  /* Shrink the buffer to what we actually need.  */
> -	  data->dirstreams[data->actdir]->content = realloc (buf, actsize);
> -	  if (data->dirstreams[data->actdir]->content == NULL)
> +	  void *content = realloc (buf, actsize);

OK. Add a new pointer, and use that instead because ->content and buf may be unspecified at failure.

> +	  if (content == NULL)
>  	    {
>  	      int save_err = errno;
>  	      free (buf);
> @@ -338,6 +338,7 @@ open_dir_stream (int *dfdp, struct ftw_data *data, struct dir_data *dirp)
>  	      data->dirstreams[data->actdir]->streamfd = -1;
>  	      data->dirstreams[data->actdir] = NULL;
>  	    }
> +	  data->dirstreams[data->actdir]->content = content;

OK. Then set the content.

>  	}
>      }
>  


-- 
Cheers,
Carlos.