bugGNU CSSC - Bugs: bug #63488, use after free bug in writesubst.cc

 
 

bug #63488: use after free bug in writesubst.cc

Submitter:  None
Submitted:  Thu 08 Dec 2022 11:43:43 AM UTC
Votes: 1
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 08 Feb 2024 07:26:21 PM UTC, comment #1: 

This affects most files using keywords, breaking one of the most obvious and useful things about source control, and can potentially cause a core dump which could prevent work on a critical file.

Michael Shon <nobodyspecial>
Thu 08 Dec 2022 11:43:43 AM UTC, original submission:  

Around line 109 we're doing expansion of the %M% keyword:

            case 'M':
              {
                const char *mod = get_module_name().c_str();
                err = fputs_failed(fputs(mod, out));
              }
            break;

Problem is that by the time the fputs is done the temporary holding the return from get_module_name has been freed, so using mod is a use after free.  This can show up as garbage being substituted in for %M%, especially when the module name is long.

A quick fix is:

             case 'M':
               {
-                const char *mod = get_module_name().c_str();
-                err = fputs_failed(fputs(mod, out));
+                string mod = get_module_name();
+                err = fputs_failed(fputs(mod.c_str(), out));
               }

(Debian bug 998642)

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nobodyspecial (Posted a comment)
  • -email is unavailable- added by nobodyspecial (Voted in favor of this item)
  •  

    There is 1 vote so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-02-08 nobodyspecial Carbon-Copy- Added nobodyspecial

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code