bugGNU Screen - Bugs: bug #43862, use-after-free, etc.

 
 

bug #43862: use-after-free, etc.

Submitter:  None
Submitted:  Sun 21 Dec 2014 10:03:36 PM UTC
   
 
Category:  Crash/Freeze/Infloop Severity:  3 - Normal
Priority:  * 5 - Normal Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Release:  4.2.1
Fixed Release:  4.4.0 Planned Release:  4.3.2
Work Required:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 05 Sep 2015 01:40:20 PM UTC, comment #1: 

Cherry picked from master into screen-v4
d8088171b2a17687fc4fb469c6d8fd17dd3deaba
371fc149965f2ba210d794ab62920847778635f2

Amadeusz Sławiński <amade>
Group administrator
Sun 21 Dec 2014 10:03:36 PM UTC, original submission:  

Hi,

In canvas.c on lines 772-783(aprox.)
"cv->c_slback" may be freed, but then used.



777      FreePerp(cv->c_slprev ? cv->c_slprev : cv->c_slnext);
778      FreePerp(cv->c_slback);
779    }
780  xs = cv->c_slback->c_xs;
781  xe = cv->c_slback->c_xe;
782  ys = cv->c_slback->c_ys;
783  ye = cv->c_slback->c_ye;


Which could either cause a crash, or "undefined behavior".

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by amade (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-06-19 amade Open/ClosedOpen Closed
        Fixed ReleaseNone 4.4.0
    2015-09-05 amade StatusNone Fixed
        Planned ReleaseNone 4.3.2

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code