From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/9045 Path: news.gmane.org!not-for-mail From: Markus Wichmann Newsgroups: gmane.linux.lib.musl.general Subject: Re: [PATCH] fix use of pointer after free in unsetenv Date: Mon, 4 Jan 2016 08:42:09 +0100 Message-ID: <20160104074208.GA2016@debian> References: <5689AA38.60108@openwall.com> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1451893350 8534 80.91.229.3 (4 Jan 2016 07:42:30 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Mon, 4 Jan 2016 07:42:30 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-9058-gllmg-musl=m.gmane.org@lists.openwall.com Mon Jan 04 08:42:26 2016 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1aFzmb-0001KX-3S for gllmg-musl@m.gmane.org; Mon, 04 Jan 2016 08:42:25 +0100 Original-Received: (qmail 9251 invoked by uid 550); 4 Jan 2016 07:42:22 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 9231 invoked from network); 4 Jan 2016 07:42:22 -0000 Content-Disposition: inline In-Reply-To: <5689AA38.60108@openwall.com> User-Agent: Mutt/1.5.23 (2014-03-12) X-Provags-ID: V03:K0:uenSzdYPuqSpKa7clCcC8K2JP4csUf/JBweK9nME1Hl3Q6RxNuV pY5Z1b7DIZbXT8NMkoPfacb/sFlmCoyPcwOOinDX9SQPyw1Q1X7lbc7+zO9aB0MM9pIArW3 d/DOZHnK+jdYpeOMjFl9SVq/gRVz8eI5OR42XmhrYLZ4soaf7mmlp6+IrhgfloRutdj+4fw SHd1IUo94+MZBGegOoFIg== X-UI-Out-Filterresults: notjunk:1;V01:K0:OINVnrsjfCc=:W1W1uFN804lR1/CCi8xWg+ HC8rLvfTBb5S9hyoAa+v9hgKMmrKJlSSbOPPo/4Lw0eCGRkxRUg76uuTExGCIfFhe9UqLimQ+ urPIpd87IE3ObNbeMpOoDqdFBcKMhgozPu6EG3hU7DrPTQgwUD7HIED27KZiPrvv2V1D4lOPI PcguO0Yko8BJcFH7SzgCI3cUNtMWE0qgB5kODpp3f/pExIiDAPKVQVR4CaLc/7fQ7c00p3u+f uB1LS8hi60GxrkSkG2XVwT89Vbd/kPSiAPlVuHYV277oA2GQ2+WdgrOtCHcBixWleVEugKDqb GmCvuTtEJJWpBzyU5DQxaPGlWwK69LMHWKABwP1iAgnybGuMSJe5dP0Yw2jhB7znlSEWgDHzr 2cVvDcjWxOh7spgd7Rn+dIyjfzPX4E1ApyGLUKKS/tiA6vvjrByLmxB3L4ecMRWixXmNN9iiE iaicuCh0f9SAdUyjZ3m28uazMBW3GGUzrZzCsGJWNpmr34vjxx4Tmqy9Dyly6cSd2onNQHguz ym3Bcz793oNabIsEtjljzSFQAGi0PuSkEjucazsbktEw07fmjwK8t7tr1Ka8b8rC69lwyD3+z 5A7VPpDXjZGJiSXhsm3oyEsfR6Q68llW6xz7k3N57Cg5im3F+Thj/vjpEt9khPTJU7dtBOEsc Yq7TMM6injSxi1cl0SsQVxBKnYZRVUhQLIIybVA53hSFndWGBPidEN+3FvsqmMJycLzzMZZTb f+ZoGXI0ByvQNua1PLoXlKHNWSitFy8LHhjTpmSLhjj7cVz+6NZL4C+qE2w= Xref: news.gmane.org gmane.linux.lib.musl.general:9045 Archived-At: On Mon, Jan 04, 2016 at 02:09:44AM +0300, Alexander Cherepanov wrote: > Hi! > > The code in [1] uses a pointer which was freed and hence has an > indeterminate value. Patch attached. > > [1] http://git.musl-libc.org/cgit/musl/tree/src/env/unsetenv.c#n23 > What are you talking about? free() ends the lifetime of the object pointed to by the argument given. However, after the free() only the pointer itself is used. It won't be dereferenced again, and instead will be immediately overwritten with a valid pointer. And while it is possible that the pointer becomes so invalid that even loading it causes undefined behavior, this doesn't happen on any of the supported systems (it might happen on i386 with segmentation, but Linux/i386, which is the only supported OS for musl, doesn't use segmentation). So it looks like unnecessary complexity to me to apply this patch. Ciao, Markus