Commit 2d5393b
src: fix freeing unintialized pointer bug in ParseSoaReply
ares_expand_name doesn't guarantee that pointer variable is initialized
if return code is ARES_EBADNAME or ARES_ENOMEM. But current usage of the
function in the codebase thinks otherwise.
There seems to be an assumption that pointer is always initialized even
though it is a local variable and we create a unique pointer soon after
calling ares_expand_name. This could potentially crash the program with
an invalid free pointer.
I was able to crash it by poisoning the memory and some manual hooks.
By moving the unique_ptr after checking the return code we can fix the
problem. As the underlying function guarantees that pointer is
initialized when the status is ARES_SUCCESS.
PR-URL: #35502
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Rich Trott <rtrott@gmail.com>1 parent dec004f commit 2d5393bCopy full SHA for 2d5393b
File tree
Expand file treeCollapse file tree
1 file changed
+10
-8
lines changedOpen diff view settings
Filter options
- src
Expand file treeCollapse file tree
1 file changed
+10
-8
lines changedOpen diff view settings
Collapse file
+10-8Lines changed: 10 additions & 8 deletions
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| ||
1067 | 1067 | |
1068 | 1068 | |
1069 | 1069 | |
1070 | | - |
| 1070 | + |
1071 | 1071 | |
1072 | 1072 | |
1073 | | - |
1074 | 1073 | |
1075 | 1074 | |
1076 | 1075 | |
1077 | 1076 | |
1078 | 1077 | |
| 1078 | + |
| 1079 | + |
1079 | 1080 | |
1080 | 1081 | |
1081 | 1082 | |
1082 | 1083 | |
1083 | 1084 | |
1084 | 1085 | |
1085 | | - |
| 1086 | + |
1086 | 1087 | |
1087 | 1088 | |
1088 | | - |
1089 | 1089 | |
1090 | 1090 | |
1091 | 1091 | |
1092 | 1092 | |
| 1093 | + |
| 1094 | + |
1093 | 1095 | |
1094 | 1096 | |
1095 | 1097 | |
| ||
1101 | 1103 | |
1102 | 1104 | |
1103 | 1105 | |
1104 | | - |
| 1106 | + |
1105 | 1107 | |
1106 | 1108 | |
1107 | 1109 | |
1108 | 1110 | |
1109 | 1111 | |
1110 | | - |
1111 | 1112 | |
1112 | 1113 | |
1113 | 1114 | |
| 1115 | + |
1114 | 1116 | |
1115 | 1117 | |
1116 | | - |
| 1118 | + |
1117 | 1119 | |
1118 | 1120 | |
1119 | 1121 | |
1120 | 1122 | |
1121 | | - |
1122 | 1123 | |
1123 | 1124 | |
1124 | 1125 | |
| 1126 | + |
1125 | 1127 | |
1126 | 1128 | |
1127 | 1129 | |
|
0 commit comments