bugGNU Screen - Bugs: bug #52133, Use after free of D_xtable in...

 
 

bug #52133: Use after free of D_xtable in FreeDisplay

Submitted by:  None
Submitted on:  Thu 28 Sep 2017 01:57:21 AM UTC  
 
Category: Crash/Freeze/InfloopSeverity: 3 - Normal
Priority: 5 - NormalStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: ClosedRelease: 4.6.1
Fixed Release: 4.6.2Planned Release: 4.6.2
Work Required: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 23 Oct 2017 12:37:31 PM UTC, comment #2:

Should be fixed in 4.6.2 release.

Amadeusz Sławiński <amade>
Project Administrator
Thu 28 Sep 2017 08:57:08 AM UTC, comment #1:

Thanks, applied to screen-v4 and master.

Amadeusz Sławiński <amade>
Project Administrator
Thu 28 Sep 2017 01:57:21 AM UTC, original submission:

FreeDisplay() first calls FreeTransTable which frees D_xtable but does not modify the value of D_xtable. Then SetTTY is called which calls Msg when an error occurs. This can cause a segfault when RAW_PUTCHAR tries to access the memory pointed to by D_xtable.

  1. 0x000055583e7032a4 in RAW_PUTCHAR (c=110) at display.c:656

1 0x000055583e6cbe4c in PutWinMsg (s=0x55583e932801 <winmsg_buf+1> "clark-dt -* ",
s@entry=0x55583e932800 <winmsg_buf> "nclark-dt -* ", start=<optimized out>, start@entry=0, max=40, max@entry=49) at screen.c:3053
2 0x000055583e7003f6 in PrePutWinMsg (s=0x55583e932800 <winmsg_buf> "nclark-dt -* ", start=0, max=49) at display.c:2174
3 0x000055583e705339 in RefreshLine (y=65, from=<optimized out>, to=48, isblank=0) at display.c:2399
4 0x000055583e70630c in MakeStatus (msg=0x7ffeaa03d7d0 "SetTTY (fd 3): ioctl failed: Input/output error") at display.c:2056
5 0x000055583e6c8a68 in Msg (err=<optimized out>, fmt=<optimized out>) at screen.c:2091
6 0x000055583e6c83a1 in CoreDump (sigsig=<optimized out>) at screen.c:1664
7 <signal handler called>
8 0x000055583e7032a4 in RAW_PUTCHAR (c=110) at display.c:656
9 0x000055583e6cbe4c in PutWinMsg (s=0x55583e932801 <winmsg_buf+1> "clark-dt -* ",
s@entry=0x55583e932800 <winmsg_buf> "nclark-dt -* ", start=<optimized out>, start@entry=0, max=40) at screen.c:3053
10 0x000055583e700443 in PrePutWinMsg (s=0x55583e932800 <winmsg_buf> "nclark-dt -* ", start=0, max=<optimized out>) at display.c:2165
11 0x000055583e705339 in RefreshLine (y=65, from=<optimized out>, to=48, isblank=0) at display.c:2399
12 0x000055583e70630c in MakeStatus (msg=0x7ffeaa040780 "SetTTY (fd 3): ioctl failed: Input/output error") at display.c:2056
13 0x000055583e6c8a68 in Msg (err=<optimized out>, fmt=<optimized out>, fmt@entry=0x55583e719f41 "SetTTY (fd %d): ioctl failed") at screen.c:2091
14 0x000055583e6dfadc in SetTTY (fd=<optimized out>, mp=<optimized out>) at tty.c:624
15 0x000055583e707d08 in FreeDisplay () at display.c:340
16 0x000055583e6c8612 in Detach (mode=mode@entry=2) at screen.c:2000
17 0x000055583e6dbb52 in FinishDetach (m=0x55583e933b80 <m>) at socket.c:1607
18 0x000055583e6ddcd5 in FinishAttach (m=m@entry=0x55583e933b80 <m>) at socket.c:1424
19 0x000055583e6de531 in ReceiveMsg () at socket.c:1235
20 0x000055583e711583 in sched () at sched.c:237
21 0x000055583e6c7113 in main (ac=0, av=<optimized out>) at screen.c:1466

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #41912:  0001-termcap.c-in-FreeTransTable-set-D_xtable-to-NULL.patch added by None (3KiB - text/x-patch - Patch to set D_xtable to NULL after free)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by amade (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 23 Oct 2017 12:37:31 PM UTCamadeOpen/ClosedOpen=>Closed
      Fixed ReleaseNone=>4.6.2
    Thu 28 Sep 2017 08:57:08 AM UTCamadeStatusNone=>Fixed
      Planned ReleaseNone=>4.6.2
    Thu 28 Sep 2017 01:57:21 AM UTCNoneAttached File-=>Added 0001-termcap.c-in-FreeTransTable-set-D_xtable-to-NULL.patch, #41912

    Back to the top


    Powered by Savane 3.1-cleanup1