bugGNU Mailutils - Bugs: bug #39006, use already free memory in...

 
 

bug #39006: use already free memory in mu_url_parse() in mailbox/url.c (mailutils 2.2)

Submitted by:  Maxim Zakharov <maxime2>
Submitted on:  Thu 16 May 2013 04:37:18 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Invalid
Privacy: PublicAssigned to: Sergey Poznyakoff <gray>
Open/Closed: Open

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 04 Feb 2014 11:31:33 AM UTC, comment #1:

Thanks for noticing. However, that code is already gone and 2.99.x uses another approach.

Sergey Poznyakoff <gray>
Project AdministratorIn charge of this item.
Thu 16 May 2013 04:37:18 AM UTC, original submission:

Hi,

there is an issue with memory handling in function mu_url_parse() in mailbox/url.c (mailutils 2.2)

Here is the code excerpt with the problem:

if (u.secret)
{
/* Obfuscate the password */
#define PASS_REPL "***"
#define PASS_REPL_LEN (sizeof (PASS_REPL) - 1)
size_t plen = mu_secret_length (u.secret);
size_t nlen = strlen (url->name);
size_t len = nlen - plen + PASS_REPL_LEN + 1;
char *newname;

memset (url->name + pstart, 0, plen);
newname = realloc (url->name, len);
if (!newname)
goto CLEANUP;
memmove (newname + pstart + PASS_REPL_LEN, newname + pstart + plen,
nlen - (pstart + plen) + 1);
memcpy (newname + pstart, PASS_REPL, PASS_REPL_LEN);
url->name = newname;
}

You can not use memory past len bytes after realloc() call, as this memory is already free to use to any other thread or process, so the memomove() call after this point is using alredy free memory (please note the value of len is less that nlen in the case when plen is greater than PASS_REPL_LEN + 1). On most system this trick with reallocation works but it's an invalid practise and can cause a problem for an application with aggressive memory allocations.

The proposed modification for this code is:

if (u.secret)
{
/* Obfuscate the password */
#define PASS_REPL "***"
#define PASS_REPL_LEN (sizeof (PASS_REPL) - 1)
size_t plen = mu_secret_length (u.secret);
size_t nlen = strlen (url->name);
size_t len = nlen + PASS_REPL_LEN + 1;
char *newname;

memset (url->name + pstart, 0, plen);
newname = realloc (url->name, len);
if (!newname)
goto CLEANUP;
memmove (newname + pstart + PASS_REPL_LEN, newname + pstart + plen,
nlen - (pstart + plen) + 1);
memcpy (newname + pstart, PASS_REPL, PASS_REPL_LEN);
newname = realloc (newname, len - plen);
if (!newname)
goto CLEANUP;
url->name = newname;
}

Maxim Zakharov <maxime2>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by gray (Posted a comment)
  • -unavailable- added by maxime2 (Submitted the item)
  • -unavailable- added by maxime2
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 04 Feb 2014 11:31:33 AM UTCgrayStatusNone=>Invalid
      Assigned toNone=>gray
    Thu 16 May 2013 04:37:18 AM UTCmaxime2Carbon-Copy-=>Added -unavailable-

    Back to the top


    Powered by Savane 3.1-cleanup