From: Peter Wagner <tripolar@gmx.at>
To: musl@lists.openwall.com
Subject: Freeing the ai_canonname in the getaddrinfo directly leads to a Segmentation fault
Date: Sun, 17 Feb 2019 15:55:31 +0100 [thread overview]
Message-ID: <20190217155531.31d2d938@onion.lan> (raw)
Hello,
after the latest update to musl 1.1.21 this code compiles on glibc
without a problem and works. It compiles for musl too but it crashes at
the free.
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
int main(){
int error;
const char *paddr = "192.168.1.1";
struct addrinfo *ai = NULL;
struct addrinfo hint = {
/* don't return duplicates */
.ai_protocol = (int)IPPROTO_UDP,
.ai_flags = AI_NUMERICHOST,
.ai_family = AF_UNSPEC,
};
error = getaddrinfo(paddr, NULL, &hint, &ai);
if ( ! error )
{
free(ai->ai_canonname); /* crashes here*/
}
}
The gdb backtrace:
(gdb) c
Continuing.
Program received signal SIGSEGV, Segmentation fault.
__bin_chunk (self=0x77ffffbc) at src/malloc/malloc.c:450
450 if (next->psize != self->csize) a_crash();
(gdb) bt
#0 __bin_chunk (self=0x77ffffbc) at src/malloc/malloc.c:450
#1 0x004006b0 in main () at foo.c:22
The corresponding code in malloc.c:
│449 /* Crash on corrupted footer (likely from buffer overflow) */
│ >│450 if (next->psize != self->csize) a_crash();
Shouldn't it be possible to free a part of a structure instead of
freeing the addrinfo structure ai points to as a whole?
Regards,
Peter Wagner
next reply other threads:[~2019-02-17 14:55 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-17 14:55 Peter Wagner [this message]
2019-02-17 16:00 ` Rich Felker
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190217155531.31d2d938@onion.lan \
--to=tripolar@gmx.at \
--cc=musl@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).