From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: AS22989 209.51.188.0/24 X-Spam-Status: No, score=-3.3 required=3.0 tests=AWL,BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS shortcircuit=no autolearn=ham autolearn_force=no version=3.4.2 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dcvr.yhbt.net (Postfix) with ESMTPS id 9AA961F466 for ; Fri, 17 Jan 2020 19:52:46 +0000 (UTC) Received: from localhost ([::1]:34106 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1isXfh-00012A-4C for normalperson@yhbt.net; Fri, 17 Jan 2020 14:52:45 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:43651) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1isXfb-00011d-Ci for bug-gnulib@gnu.org; Fri, 17 Jan 2020 14:52:42 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1isXfY-0006Tl-9r for bug-gnulib@gnu.org; Fri, 17 Jan 2020 14:52:39 -0500 Received: from zimbra.cs.ucla.edu ([131.179.128.68]:60478) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1isXfX-0006RM-VA for bug-gnulib@gnu.org; Fri, 17 Jan 2020 14:52:36 -0500 Received: from localhost (localhost [127.0.0.1]) by zimbra.cs.ucla.edu (Postfix) with ESMTP id 22EFA160066; Fri, 17 Jan 2020 11:52:34 -0800 (PST) Received: from zimbra.cs.ucla.edu ([127.0.0.1]) by localhost (zimbra.cs.ucla.edu [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id tDr2up7Vk6mC; Fri, 17 Jan 2020 11:52:33 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by zimbra.cs.ucla.edu (Postfix) with ESMTP id 03790160067; Fri, 17 Jan 2020 11:52:33 -0800 (PST) X-Virus-Scanned: amavisd-new at zimbra.cs.ucla.edu Received: from zimbra.cs.ucla.edu ([127.0.0.1]) by localhost (zimbra.cs.ucla.edu [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id Xf43NhP3G6sz; Fri, 17 Jan 2020 11:52:32 -0800 (PST) Received: from Penguin.CS.UCLA.EDU (Penguin.CS.UCLA.EDU [131.179.64.200]) by zimbra.cs.ucla.edu (Postfix) with ESMTPSA id DA504160066; Fri, 17 Jan 2020 11:52:32 -0800 (PST) Subject: Re: heap-use-after-free in rpl_glob To: Bruno Haible References: <6008915.UEnMCXWWPA@omega> From: Paul Eggert Organization: UCLA Computer Science Department Message-ID: <3c926e49-6d61-21d5-7688-d830b029341c@cs.ucla.edu> Date: Fri, 17 Jan 2020 11:52:28 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 MIME-Version: 1.0 In-Reply-To: <6008915.UEnMCXWWPA@omega> Content-Type: multipart/mixed; boundary="------------0D399790D69E96B65C919992" Content-Language: en-US X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-Received-From: 131.179.128.68 X-BeenThere: bug-gnulib@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Gnulib discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: =?UTF-8?Q?Tim_R=c3=bchsen?= , bug-gnulib@gnu.org Errors-To: bug-gnulib-bounces+normalperson=yhbt.net@gnu.org Sender: "bug-gnulib" This is a multi-part message in MIME format. --------------0D399790D69E96B65C919992 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit On 1/17/20 9:00 AM, Bruno Haible wrote: > Thank you very much for this report! I expect that the fix will also need > to go into glibc. Yes, thanks, I filed a bug report here: https://sourceware.org/bugzilla/show_bug.cgi?id=25414 It seems that your patch is incomplete, as there's a memory leak in the unlikely case that the malloc call fails. Something like the attached patch instead, perhaps? --------------0D399790D69E96B65C919992 Content-Type: text/x-patch; charset=UTF-8; name="0001-glob-Fix-use-after-free-bug.patch" Content-Disposition: attachment; filename="0001-glob-Fix-use-after-free-bug.patch" Content-Transfer-Encoding: quoted-printable >From 8d5f7d7e43b8830acde4f82b93cc7b970d9ec435 Mon Sep 17 00:00:00 2001 From: Bruno Haible Date: Fri, 17 Jan 2020 11:51:26 -0800 Subject: [PATCH] glob: Fix use-after-free bug. MIME-Version: 1.0 Content-Type: text/plain; charset=3DUTF-8 Content-Transfer-Encoding: 8bit Reported by Tim R=C3=BChsen in . * lib/glob.c (__glob): Delay freeing dirname until after the use of end_name. --- ChangeLog | 9 +++++++++ lib/glob.c | 21 +++++++++++++-------- 2 files changed, 22 insertions(+), 8 deletions(-) diff --git a/ChangeLog b/ChangeLog index 643dba312..04b139a6a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,12 @@ +2020-01-17 Bruno Haible + Paul Eggert + + glob: Fix use-after-free bug. + Reported by Tim R=C3=BChsen in + . + * lib/glob.c (__glob): Delay freeing dirname until after the use of + end_name. + 2020-01-16 Siddhesh Poyarekar =20 vcs-to-changelog: Fix parsing of fndecl without args. diff --git a/lib/glob.c b/lib/glob.c index a67cbb67e..e0928312a 100644 --- a/lib/glob.c +++ b/lib/glob.c @@ -843,24 +843,27 @@ __glob (const char *pattern, int flags, int (*errfu= nc) (const char *, int), { size_t home_len =3D strlen (p->pw_dir); size_t rest_len =3D end_name =3D=3D NULL ? 0 : strlen (e= nd_name); + /* dirname contains end_name; we can't free it now. */ + char *prev_dirname =3D + (__glibc_unlikely (malloc_dirname) ? dirname : NULL); char *d; =20 - if (__glibc_unlikely (malloc_dirname)) - free (dirname); - malloc_dirname =3D 0; - if (glob_use_alloca (alloca_used, home_len + rest_len + = 1)) - dirname =3D alloca_account (home_len + rest_len + 1, - alloca_used); + { + dirname =3D alloca_account (home_len + rest_len + 1, + alloca_used); + malloc_dirname =3D 0; + } else { - dirname =3D malloc (home_len + rest_len + 1); - if (dirname =3D=3D NULL) + char *new_dirname =3D malloc (home_len + rest_len + = 1); + if (new_dirname =3D=3D NULL) { scratch_buffer_free (&pwtmpbuf); retval =3D GLOB_NOSPACE; goto out; } + dirname =3D new_dirname; malloc_dirname =3D 1; } d =3D mempcpy (dirname, p->pw_dir, home_len); @@ -868,6 +871,8 @@ __glob (const char *pattern, int flags, int (*errfunc= ) (const char *, int), d =3D mempcpy (d, end_name, rest_len); *d =3D '\0'; =20 + free (prev_dirname); + dirlen =3D home_len + rest_len; dirname_modified =3D 1; } --=20 2.24.1 --------------0D399790D69E96B65C919992--