From: Markus Wichmann <nullplan@gmx.net>
To: musl@lists.openwall.com
Subject: Re: [PATCH] fix use of pointer after free in unsetenv
Date: Mon, 4 Jan 2016 08:42:09 +0100 [thread overview]
Message-ID: <20160104074208.GA2016@debian> (raw)
In-Reply-To: <5689AA38.60108@openwall.com>
On Mon, Jan 04, 2016 at 02:09:44AM +0300, Alexander Cherepanov wrote:
> Hi!
>
> The code in [1] uses a pointer which was freed and hence has an
> indeterminate value. Patch attached.
>
> [1] http://git.musl-libc.org/cgit/musl/tree/src/env/unsetenv.c#n23
>
What are you talking about? free() ends the lifetime of the object
pointed to by the argument given. However, after the free() only the
pointer itself is used. It won't be dereferenced again, and instead will
be immediately overwritten with a valid pointer. And while it is
possible that the pointer becomes so invalid that even loading it causes
undefined behavior, this doesn't happen on any of the supported systems
(it might happen on i386 with segmentation, but Linux/i386, which is the
only supported OS for musl, doesn't use segmentation).
So it looks like unnecessary complexity to me to apply this patch.
Ciao,
Markus
next prev parent reply other threads:[~2016-01-04 7:42 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-03 23:09 Alexander Cherepanov
2016-01-04 3:05 ` Rich Felker
2016-01-04 10:52 ` Alexander Cherepanov
2016-01-04 11:56 ` Alexander Monakov
2016-01-04 15:47 ` Alexander Monakov
2016-01-04 21:05 ` Rich Felker
2016-01-04 21:28 ` Alexander Monakov
2016-01-04 21:53 ` Rich Felker
2016-01-04 7:42 ` Markus Wichmann [this message]
2016-01-04 11:58 ` Alexander Cherepanov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160104074208.GA2016@debian \
--to=nullplan@gmx.net \
--cc=musl@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).