bugGNU Mailutils - Bugs: bug #39006, use already free memory in...

 
 

bug #39006: use already free memory in mu_url_parse() in mailbox/url.c (mailutils 2.2)

Submitter:  Maxim Zakharov <maxime2>
Submitted:  Thu 16 May 2013 04:37:18 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Invalid
Privacy:  Public Assigned to:  gray
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 04 Feb 2014 11:31:33 AM UTC, comment #1: 

Thanks for noticing. However, that code is already gone and 2.99.x uses another approach.

Sergey Poznyakoff <gray>
Group administrator
Thu 16 May 2013 04:37:18 AM UTC, original submission:  

Hi,

there is an issue with memory handling in function mu_url_parse() in mailbox/url.c  (mailutils 2.2)


Here is the code excerpt with the problem:

      if (u.secret)
{
  /* Obfuscate the password */
#define PASS_REPL "***"
#define PASS_REPL_LEN (sizeof (PASS_REPL) - 1)
  size_t plen = mu_secret_length (u.secret);
  size_t nlen = strlen (url->name);
  size_t len = nlen - plen + PASS_REPL_LEN + 1;
  char *newname;

  memset (url->name + pstart, 0, plen);
  newname = realloc (url->name, len);
  if (!newname)
    goto CLEANUP;
  memmove (newname + pstart + PASS_REPL_LEN, newname + pstart + plen,
   nlen - (pstart + plen) + 1);
  memcpy (newname + pstart, PASS_REPL, PASS_REPL_LEN);
  url->name = newname;
}


You can not use memory past len bytes after realloc() call, as this memory is already free to use to any other thread or process, so the memomove() call after this point is using alredy free memory (please note the value of len is less that nlen in the case when plen is greater than PASS_REPL_LEN + 1). On most system this trick with reallocation works but it's an invalid practise and can cause a problem for an application with aggressive memory allocations.



The proposed modification for this code is:

     if (u.secret)
{
  /* Obfuscate the password */
#define PASS_REPL "***"
#define PASS_REPL_LEN (sizeof (PASS_REPL) - 1)
  size_t plen = mu_secret_length (u.secret);
  size_t nlen = strlen (url->name);
  size_t len = nlen + PASS_REPL_LEN + 1;
  char *newname;

  memset (url->name + pstart, 0, plen);
  newname = realloc (url->name, len);
  if (!newname)
    goto CLEANUP;
  memmove (newname + pstart + PASS_REPL_LEN, newname + pstart + plen,
   nlen - (pstart + plen) + 1);
  memcpy (newname + pstart, PASS_REPL, PASS_REPL_LEN);
  newname = realloc (newname, len - plen);
  if (!newname)
    goto CLEANUP;
  url->name = newname;
}

Maxim Zakharov <maxime2>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gray (Posted a comment)
  • -email is unavailable- added by maxime2 (Submitted the item)
  • -email is unavailable- added by maxime2
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-07-25 gray Open/ClosedOpen Closed
    2014-02-04 gray StatusNone Invalid
        Assigned toNone gray
    2013-05-16 maxime2 Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code