bugGNU Screen - Bugs: bug #52133, Use after free of D_xtable in...

 
 

bug #52133: Use after free of D_xtable in FreeDisplay

Submitter:  None
Submitted:  Thu 28 Sep 2017 01:57:21 AM UTC
   
 
Category:  Crash/Freeze/Infloop Severity:  3 - Normal
Priority:  * 5 - Normal Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Release:  4.6.1
Fixed Release:  4.6.2 Planned Release:  4.6.2
Work Required:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 23 Oct 2017 12:37:31 PM UTC, comment #2: 

Should be fixed in 4.6.2 release.

Amadeusz Sławiński <amade>
Group administrator
Thu 28 Sep 2017 08:57:08 AM UTC, comment #1: 

Thanks, applied to screen-v4 and master.

Amadeusz Sławiński <amade>
Group administrator
Thu 28 Sep 2017 01:57:21 AM UTC, original submission:  

FreeDisplay() first calls FreeTransTable which frees D_xtable but does not modify the value of D_xtable. Then SetTTY is called which calls Msg when an error occurs. This can cause a segfault when RAW_PUTCHAR tries to access the memory pointed to by D_xtable.

  1.  0x000055583e7032a4 in RAW_PUTCHAR (c=110) at display.c:656

1  0x000055583e6cbe4c in PutWinMsg (s=0x55583e932801 <winmsg_buf+1> "clark-dt -*  ",
   s@entry=0x55583e932800 <winmsg_buf> "nclark-dt -*  ", start=<optimized out>, start@entry=0, max=40, max@entry=49) at screen.c:3053
2  0x000055583e7003f6 in PrePutWinMsg (s=0x55583e932800 <winmsg_buf> "nclark-dt -*  ", start=0, max=49) at display.c:2174
3  0x000055583e705339 in RefreshLine (y=65, from=<optimized out>, to=48, isblank=0) at display.c:2399
4  0x000055583e70630c in MakeStatus (msg=0x7ffeaa03d7d0 "SetTTY (fd 3): ioctl failed: Input/output error") at display.c:2056
5  0x000055583e6c8a68 in Msg (err=<optimized out>, fmt=<optimized out>) at screen.c:2091
6  0x000055583e6c83a1 in CoreDump (sigsig=<optimized out>) at screen.c:1664
7  <signal handler called>
8  0x000055583e7032a4 in RAW_PUTCHAR (c=110) at display.c:656
9  0x000055583e6cbe4c in PutWinMsg (s=0x55583e932801 <winmsg_buf+1> "clark-dt -*  ",
   s@entry=0x55583e932800 <winmsg_buf> "nclark-dt -*  ", start=<optimized out>, start@entry=0, max=40) at screen.c:3053
10 0x000055583e700443 in PrePutWinMsg (s=0x55583e932800 <winmsg_buf> "nclark-dt -*  ", start=0, max=<optimized out>) at display.c:2165
11 0x000055583e705339 in RefreshLine (y=65, from=<optimized out>, to=48, isblank=0) at display.c:2399
12 0x000055583e70630c in MakeStatus (msg=0x7ffeaa040780 "SetTTY (fd 3): ioctl failed: Input/output error") at display.c:2056
13 0x000055583e6c8a68 in Msg (err=<optimized out>, fmt=<optimized out>, fmt@entry=0x55583e719f41 "SetTTY (fd %d): ioctl failed") at screen.c:2091
14 0x000055583e6dfadc in SetTTY (fd=<optimized out>, mp=<optimized out>) at tty.c:624
15 0x000055583e707d08 in FreeDisplay () at display.c:340
16 0x000055583e6c8612 in Detach (mode=mode@entry=2) at screen.c:2000
17 0x000055583e6dbb52 in FinishDetach (m=0x55583e933b80 <m>) at socket.c:1607
18 0x000055583e6ddcd5 in FinishAttach (m=m@entry=0x55583e933b80 <m>) at socket.c:1424
19 0x000055583e6de531 in ReceiveMsg () at socket.c:1235
20 0x000055583e711583 in sched () at sched.c:237
21 0x000055583e6c7113 in main (ac=0, av=<optimized out>) at screen.c:1466

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #41912:  0001-termcap.c-in-FreeTransTable-set-D_xtable-to-NULL.patch added by None (3KiB - text/x-patch - Patch to set D_xtable to NULL after free)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by amade (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-10-23 amade Open/ClosedOpen Closed
        Fixed ReleaseNone 4.6.2
    2017-09-28 amade StatusNone Fixed
        Planned ReleaseNone 4.6.2
    2017-09-28 None Attached File- Added 0001-termcap.c-in-FreeTransTable-set-D_xtable-to-NULL.patch, #41912

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code