bugGNU Wget - Bugs: bug #44300, Possible double free in...

 
 

bug #44300: Possible double free in ftp_retrieve_glob

Submitter:  John L. Whiteman <jlwhiteman>
Submitted:  Wed 18 Feb 2015 10:46:24 PM UTC
   
 
Category:  Program Logic Severity:  3 - Normal
Priority:  5 - Normal Status:  Invalid
Privacy:  Public Assigned to:  None
Originator Name:  jlwhiteman Open/Closed:  Closed
Release:  None Operating System:  GNU/Linux
Reproducibility:  None Fixed Release:  None
Planned Release:  None Regression:  None
Work Required:  None Patch Included:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 19 Feb 2015 06:09:42 PM UTC, comment #2: 

Thank you for the quick turn around.  I wasn't 100% sure if the condition could be met so I posted it to be on the safe side.  Regarding code analysis, it was done against multiple open source packages which happened to include GNU Wget.  It's really good that this is already being done.

John L. Whiteman <jlwhiteman>
Thu 19 Feb 2015 04:34:06 AM UTC, comment #1: 

I'm not so sure that this is a valid bug. Coverity is known to report a lot of false positives.

Upon a cursory reading of the code, I think this is from the patch I wrote for handling CVE-2014-4877. Let me note a few points:

delelement returns a new pointer to the start of the link list. Also, the function checks if "f" is the first element, in which case it will move the start pointer to the next valid element.

In case there are no more elements in the link list, start will be set to NULL.

On line 2347, we check if the start is not NULL. Hence, when the control reaches line 2350, start is guaranteed to be a valid pointer.


P.S.: Are you running static analysis on GNU Wget on your own? Because I do run Wget through coverity about once a month.

Darshit Shah <darnir>
Group administrator
Wed 18 Feb 2015 10:46:24 PM UTC, original submission:  

Based on Coverity static analysis results against wget code. In particular this was found in src/ftp.c (ftp_retrieve_glob()). This condition may be difficult to reach.  See PDF attachment for screenshot details.

John L. Whiteman <jlwhiteman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #33124:  wgetscanresults.pdf added by jlwhiteman (153KiB - application/pdf - scan screenshots)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by darnir (Posted a comment)
  • -email is unavailable- added by jlwhiteman (Submitted the item)
  •  

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-03-02 darnir Open/ClosedOpen Closed
    2015-02-19 darnir StatusNone Invalid
    2015-02-18 jlwhiteman Attached File- Added wgetscanresults.pdf, #33124

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code