Re: [PATCH] bridge: leases: Fix potential crash caused by use after free

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 06/24/14 13:54, Peter Krempa wrote:
> Don't free individual JSON array members as the array will be freed at
> the end. This may potentially lead to a crash although it didn't crash
> on my setup.
> ---
>  src/network/bridge_driver.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
> 

It crashed now in valgrind:

==2487543== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==2487543==  Access not within mapped region at address 0x0
==2487543==    at 0x52ADAF7: virFree (viralloc.c:582)
==2487543==    by 0x52E76D3: virJSONValueFree (virjson.c:76)
==2487543==    by 0x52E773F: virJSONValueFree (virjson.c:83)
==2487543==    by 0x1317A8F8: networkGetDHCPLeasesHelper (bridge_driver.c:3533)
==2487543==    by 0x1317ABFE: networkGetDHCPLeasesForMAC (bridge_driver.c:3586)
==2487543==    by 0x541D2E1: virNetworkGetDHCPLeasesForMAC (libvirt.c:21154)
==2487543==    by 0x159082: remoteDispatchNetworkGetDHCPLeasesForMAC (remote.c:6347)
==2487543==    by 0x13D0B7: remoteDispatchNetworkGetDHCPLeasesForMACHelper (remote_dispatch.h:10355)
==2487543==    by 0x547B0D1: virNetServerProgramDispatchCall (virnetserverprogram.c:437)
==2487543==    by 0x547AC2E: virNetServerProgramDispatch (virnetserverprogram.c:307)
==2487543==    by 0x170443: virNetServerProcessMsg (virnetserver.c:172)
==2487543==    by 0x170529: virNetServerHandleJob (virnetserver.c:193)

I was apparently lucky before and the pointers mapped to memory that was still mapped.

Peter

Attachment: signature.asc
Description: OpenPGP digital signature

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list

[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]