tools/proftool: fix use-after-free
PATCH 1/1 tools/proftool: fix use-after-free
The read_trace_config() can dereference the line pointer after freeing it on its error path. Avoid that.
This was found by Coverity Scan.
--- tools/proftool.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/proftool.c +3 -2
@@ -432,9 +432,10 @@ static int read_trace_config(FILE *fin) err =regcomp (&line->regex, tok,REG_NOSUB );if (err) { +int r =regex_report_error (&line->regex, err, +"compile" , tok);free (line); -return regex_report_error (&line->regex, err,"compile" , - tok); +return r; }/* link this new one to the end of the list */
Signature · 1 line
2.5.3
PATCH 1/1 tools/proftool: fix use-after-free
Quoted 7 lines · Vincent Stehl?
The
read_trace_config()can dereference the line pointer after freeing it on its error path. Avoid that.This was found by Coverity Scan.
Signed-off-by Vincent Stehl? <[email protected]>Cc Simon Glass <[email protected]>
Were you in the Coverity talk too? :) I saw this error as well today now. I was actually thinking along the lines of:
tools/proftool.c +2 -1
@@ -433,8 +433,9 @@ static int read_trace_config(FILE *fin) err =regcomp (&line->regex, tok,REG_NOSUB );if (err) {free (line); -return regex_report_error (&line->regex, err,"compile" , + err =regex_report_error (&line->regex, err,"compile" , tok); +return err; }/* link this new one to the end of the list */
Signature · 8 lines
Tom -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 836 bytes Desc: Digital signature URL: <http://lists.denx.de/pipermail/u-boot/attachments/20151007/38022432/attachment.sig>
PATCH 1/1 tools/proftool: fix use-after-free
On 10/07/2015 04:19 PM, Tom Rini wrote:
..
Quoted 1 line
Were you in the Coverity talk too? :)
Hi Tom,
No, I was not following that talk, sorry.
..
tools/proftool.c static int read_trace_config(FILE *fin) · line 438
Quoted 5 lines
free(line);tools/proftool.c +2
-1-return regex_report_error (&line->regex, err,"compile" , + err =regex_report_error (&line->regex, err,"compile" , tok); +return err;
I am not sure you solve the problem this way. Indeed the structure pointed to by the line pointer will still have been freed before use even this way. Who knows what the memory contains when regerror() will access &line->regex, which is contained into the freed structure?
Best regards,
V.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: OpenPGP digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20151007/15a57976/attachment.sig>
PATCH 1/1 tools/proftool: fix use-after-free
Quoted 7 lines · Vincent Stehl?
On 10/07/2015 04:19 PM, Tom Rini wrote:
..Quoted 1 line
Were you in the Coverity talk too? :)
Hi Tom,
No, I was not following that talk, sorry.
Ah, coincidence then.
Quoted 11 lines
..
tools/proftool.c static int read_trace_config(FILE *fin) · line 438
Quoted 5 lines
free(line);tools/proftool.c +2
-1-return regex_report_error (&line->regex, err,"compile" , + err =regex_report_error (&line->regex, err,"compile" , tok); +return err;I am not sure you solve the problem this way. Indeed the structure pointed to by the line pointer will still have been freed before use even this way. Who knows what the memory contains when
regerror()will access&line->regex, which is contained into the freed structure?
Er, bah. That's what I get for writing something in the middle of listening to a talk too. I meant to also move the free() to after the regex_report_error call and just avoid adding another variable.
Signature · 8 lines
Tom -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 836 bytes Desc: Digital signature URL: <http://lists.denx.de/pipermail/u-boot/attachments/20151007/b1004c0c/attachment.sig>
Quoted 7 lines · Vincent Stehl?
The
read_trace_config()can dereference the line pointer after freeing it on its error path. Avoid that.This was found by Coverity Scan.
Signed-off-by Vincent Stehl? <[email protected]>Cc Simon Glass <[email protected]>
Applied to u-boot/master, thanks!
Signature · 8 lines
Tom -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 836 bytes Desc: Digital signature URL: <http://lists.denx.de/pipermail/u-boot/attachments/20151116/165b8d18/attachment.sig>