From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/9044 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: [PATCH] fix use of pointer after free in unsetenv Date: Sun, 3 Jan 2016 22:05:58 -0500 Message-ID: <20160104030558.GT238@brightrain.aerifal.cx> References: <5689AA38.60108@openwall.com> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1451876774 9342 80.91.229.3 (4 Jan 2016 03:06:14 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Mon, 4 Jan 2016 03:06:14 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-9057-gllmg-musl=m.gmane.org@lists.openwall.com Mon Jan 04 04:06:14 2016 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1aFvTJ-0000ri-HS for gllmg-musl@m.gmane.org; Mon, 04 Jan 2016 04:06:13 +0100 Original-Received: (qmail 28021 invoked by uid 550); 4 Jan 2016 03:06:11 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 28003 invoked from network); 4 Jan 2016 03:06:11 -0000 Content-Disposition: inline In-Reply-To: <5689AA38.60108@openwall.com> User-Agent: Mutt/1.5.21 (2010-09-15) Original-Sender: Rich Felker Xref: news.gmane.org gmane.linux.lib.musl.general:9044 Archived-At: On Mon, Jan 04, 2016 at 02:09:44AM +0300, Alexander Cherepanov wrote: > Hi! > > The code in [1] uses a pointer which was freed and hence has an > indeterminate value. Patch attached. > > [1] http://git.musl-libc.org/cgit/musl/tree/src/env/unsetenv.c#n23 The bug sounds a lot scarier than it actually is. I don't think any compilers will break this yet but it is indeed UB. > >From f446b5811a8abc08bcc8202aa241dce82d4c917d Mon Sep 17 00:00:00 2001 > From: Alexander Cherepanov > Date: Mon, 4 Jan 2016 01:40:03 +0300 > Subject: [PATCH] fix use of pointer after free in unsetenv > > the value of a pointer becomes indeterminate after free() so delay free() > until the pointer is not needed anymore. > > --- > src/env/unsetenv.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/src/env/unsetenv.c b/src/env/unsetenv.c > index 3569335..b5d8b19 100644 > --- a/src/env/unsetenv.c > +++ b/src/env/unsetenv.c > @@ -19,9 +19,10 @@ again: > if (__environ[i]) { > if (__env_map) { > for (j=0; __env_map[j] && __env_map[j] != __environ[i]; j++); > - free (__env_map[j]); > + char *t =__env_map[j]; > for (; __env_map[j]; j++) > __env_map[j] = __env_map[j+1]; > + free (t); Wouldn't something like this be simpler: do __env_map[j] = __env_map[j+1]; while (__env_map[++j]); Rich