kozorizki/haproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BUG/MINOR: pattern: pat_ref_set: fix UAF reported by coverity

Browse Source 
memprintf() performs realloc and updates then the pointer to an output buffer,
where it has written the data. So free() is called on the previous buffer
address, if it was provided.

pat_ref_set_elt() uses memprintf() to write its error message as well as
pat_ref_set(). So, when we re-enter into the while loop the second time and
pat_ref_set_elt() has returned, the *err ptr (previous value of *merr) is
already freed by memprintf() from pat_ref_set_el().

'if (!found)' condition is false at this point, because we've found a node at
the first loop. So, the second memprintf(), in order to write error messages,
does again free(*err).

This should be backported in all stable versions.

(cherry picked from commit 4f2493f3551f8c344485cccf075c3b15f9825181)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
This commit is contained in:
Valentine Krasnobaeva 2024-08-12 15:32:00 +02:00 committed by Christopher Faulet
parent b8523ffaf8
commit bf82f46ef0
1 changed files with 5 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
src/pattern.c
View File

@ -1774,17 +1774,8 @@ int pat_ref_set_by_id(struct pat_ref *ref, struct pat_ref_elt *refelt, const cha
int pat_ref_set(struct pat_ref *ref, const char *key, const char *value, char **err, struct pat_ref_elt *elt)
{
int found = 0;
char *_merr;
char **merr;
struct ebmb_node *node;
if (err) {
merr = &_merr;
*merr = NULL;
}
else
merr = NULL;
if (elt) {
node = &elt->node;
}
@ -1794,17 +1785,13 @@ int pat_ref_set(struct pat_ref *ref, const char *key, const char *value, char **
}
while (node) {
char *tmp_err = NULL;
elt = ebmb_entry(node, struct pat_ref_elt, node);
node = ebmb_next_dup(node);
if (!pat_ref_set_elt(ref, elt, value, merr)) {
if (err && merr) {
if (!found) {
*err = *merr;
} else {
memprintf(err, "%s, %s", *err, *merr);
ha_free(merr);
}
}
if (!pat_ref_set_elt(ref, elt, value, &tmp_err)) {
memprintf(err, "%s, %s", err && *err ? *err : "", tmp_err);
ha_free(&tmp_err);
}
found = 1;
}