bugGNU Wget - Bugs: bug #44300, Possible double free in...

 
 

bug #44300: Possible double free in ftp_retrieve_glob

Submitted by:  John L. Whiteman <jlwhiteman>
Submitted on:  Wed 18 Feb 2015 10:46:24 PM UTC  
 
Category: Program LogicSeverity: 3 - Normal
Priority: 5 - NormalStatus: Invalid
Privacy: PublicAssigned to: None
Originator Name: jlwhitemanOpen/Closed: Closed
Release: NoneOperating System: GNU/Linux
Reproducibility: NoneFixed Release: None
Planned Release: NoneRegression: None
Work Required: NonePatch Included: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 19 Feb 2015 06:09:42 PM UTC, comment #2:

Thank you for the quick turn around. I wasn't 100% sure if the condition could be met so I posted it to be on the safe side. Regarding code analysis, it was done against multiple open source packages which happened to include GNU Wget. It's really good that this is already being done.

John L. Whiteman <jlwhiteman>
Thu 19 Feb 2015 04:34:06 AM UTC, comment #1:

I'm not so sure that this is a valid bug. Coverity is known to report a lot of false positives.

Upon a cursory reading of the code, I think this is from the patch I wrote for handling CVE-2014-4877. Let me note a few points:

delelement returns a new pointer to the start of the link list. Also, the function checks if "f" is the first element, in which case it will move the start pointer to the next valid element.

In case there are no more elements in the link list, start will be set to NULL.

On line 2347, we check if the start is not NULL. Hence, when the control reaches line 2350, start is guaranteed to be a valid pointer.

P.S.: Are you running static analysis on GNU Wget on your own? Because I do run Wget through coverity about once a month.

Darshit Shah <darnir>
Project Administrator
Wed 18 Feb 2015 10:46:24 PM UTC, original submission:

Based on Coverity static analysis results against wget code. In particular this was found in src/ftp.c (ftp_retrieve_glob()). This condition may be difficult to reach. See PDF attachment for screenshot details.

John L. Whiteman <jlwhiteman>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #33124:  wgetscanresults.pdf added by jlwhiteman (153KiB - application/pdf - scan screenshots)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by darnir (Posted a comment)
  • -unavailable- added by jlwhiteman (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 02 Mar 2015 04:51:17 PM UTCdarnirOpen/ClosedOpen=>Closed
    Thu 19 Feb 2015 04:34:06 AM UTCdarnirStatusNone=>Invalid
    Wed 18 Feb 2015 10:46:24 PM UTCjlwhitemanAttached File-=>Added wgetscanresults.pdf, #33124

    Back to the top


    Powered by Savane 3.1-cleanup1