bugGNU Screen - Bugs: bug #43862, use-after-free, etc.

 
 

bug #43862: use-after-free, etc.

Submitted by:  None
Submitted on:  Sun 21 Dec 2014 10:03:36 PM UTC  
 
Category: Crash/Freeze/InfloopSeverity: 3 - Normal
Priority: 5 - NormalStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: ClosedRelease: 4.2.1
Fixed Release: 4.4.0Planned Release: 4.3.2
Work Required: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 05 Sep 2015 01:40:20 PM UTC, comment #1:

Cherry picked from master into screen-v4
d8088171b2a17687fc4fb469c6d8fd17dd3deaba
371fc149965f2ba210d794ab62920847778635f2

Amadeusz Sławiński <amade>
Project Administrator
Sun 21 Dec 2014 10:03:36 PM UTC, original submission:

Hi,

In canvas.c on lines 772-783(aprox.)
"cv->c_slback" may be freed, but then used.

777 FreePerp(cv->c_slprev ? cv->c_slprev : cv->c_slnext);
778 FreePerp(cv->c_slback);
779 }
780 xs = cv->c_slback->c_xs;
781 xe = cv->c_slback->c_xe;
782 ys = cv->c_slback->c_ys;
783 ye = cv->c_slback->c_ye;

Which could either cause a crash, or "undefined behavior".

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by amade (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 19 Jun 2016 09:15:29 PM UTCamadeOpen/ClosedOpen=>Closed
      Fixed ReleaseNone=>4.4.0
    Sat 05 Sep 2015 01:40:20 PM UTCamadeStatusNone=>Fixed
      Planned ReleaseNone=>4.3.2

    Back to the top


    Powered by Savane 3.1-cleanup1