Freeing the ai_canonname in the getaddrinfo directly leads to a Segmentation fault

Freeing the ai_canonname in the getaddrinfo directly leads to a Segmentation fault

[Peter Wagner]

Hello,

after the latest update to musl 1.1.21 this code compiles on glibc
without a problem and works. It compiles for musl too but it crashes at
the free.

#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>

int main(){
        int error;
        const char *paddr = "192.168.1.1";
        struct addrinfo *ai = NULL;

        struct addrinfo hint = {
                /* don't return duplicates */
                .ai_protocol    = (int)IPPROTO_UDP,
                .ai_flags       = AI_NUMERICHOST,
                .ai_family      = AF_UNSPEC,
        };

        error = getaddrinfo(paddr, NULL, &hint, &ai);

        if ( ! error )
        {
                free(ai->ai_canonname); /* crashes here*/
        }
}


The gdb backtrace:

(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
__bin_chunk (self=0x77ffffbc) at src/malloc/malloc.c:450
450             if (next->psize != self->csize) a_crash();
(gdb) bt
#0  __bin_chunk (self=0x77ffffbc) at src/malloc/malloc.c:450
#1  0x004006b0 in main () at foo.c:22


The corresponding code in malloc.c:

   │449  /* Crash on corrupted footer (likely from buffer overflow)   */
│ >│450   if (next->psize != self->csize) a_crash(); 

Shouldn't it be possible to free a part of a structure instead of
freeing the addrinfo structure ai points to as a whole?

Regards,
Peter Wagner

Re: Freeing the ai_canonname in the getaddrinfo directly leads to a Segmentation fault

[Rich Felker]

On Sun, Feb 17, 2019 at 03:55:31PM +0100, Peter Wagner wrote:
> Hello,
> 
> after the latest update to musl 1.1.21 this code compiles on glibc
> without a problem and works. It compiles for musl too but it crashes at
> the free.
> 
> #include <stdlib.h>
> #include <sys/types.h>
> #include <sys/socket.h>
> #include <netdb.h>
> 
> int main(){
>         int error;
>         const char *paddr = "192.168.1.1";
>         struct addrinfo *ai = NULL;
> 
>         struct addrinfo hint = {
>                 /* don't return duplicates */
>                 .ai_protocol    = (int)IPPROTO_UDP,
>                 .ai_flags       = AI_NUMERICHOST,
>                 .ai_family      = AF_UNSPEC,
>         };
> 
>         error = getaddrinfo(paddr, NULL, &hint, &ai);
> 
>         if ( ! error )
>         {
>                 free(ai->ai_canonname); /* crashes here*/
>         }
> }
> 
> 
> The gdb backtrace:
> 
> (gdb) c
> Continuing.
> 
> Program received signal SIGSEGV, Segmentation fault.
> __bin_chunk (self=0x77ffffbc) at src/malloc/malloc.c:450
> 450             if (next->psize != self->csize) a_crash();
> (gdb) bt
> #0  __bin_chunk (self=0x77ffffbc) at src/malloc/malloc.c:450
> #1  0x004006b0 in main () at foo.c:22
> 
> 
> The corresponding code in malloc.c:
> 
>    │449  /* Crash on corrupted footer (likely from buffer overflow)   */
> │ >│450   if (next->psize != self->csize) a_crash(); 
> 
> Shouldn't it be possible to free a part of a structure instead of
> freeing the addrinfo structure ai points to as a whole?

No. Short of an explicit contract that you can, the assumption is that
you can't. Nothing says that ai_canonname points to memory "as if
obtained by malloc", or that it can be passed to free. In fact the
spec even allows it to point to the same storage as the host argument.
The relevant text is:

    "If nodename is not null, and if requested by the AI_CANONNAME
    flag, the ai_canonname field of the first returned addrinfo
    structure shall point to a null-terminated string containing the
    canonical name corresponding to the input nodename; if the
    canonical name is not available, then ai_canonname shall refer to
    the nodename argument or a string with the same contents."

Code passing this to free is just buggy.

Rich