From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/13809 Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: Freeing the ai_canonname in the getaddrinfo directly leads to a Segmentation fault Date: Sun, 17 Feb 2019 11:00:01 -0500 Message-ID: <20190217160001.GF23599@brightrain.aerifal.cx> References: <20190217155531.31d2d938@onion.lan> Reply-To: musl@lists.openwall.com Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226"; logging-data="171879"; mail-complaints-to="usenet@blaine.gmane.org" User-Agent: Mutt/1.5.21 (2010-09-15) To: musl@lists.openwall.com Original-X-From: musl-return-13825-gllmg-musl=m.gmane.org@lists.openwall.com Sun Feb 17 17:00:18 2019 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by blaine.gmane.org with smtp (Exim 4.89) (envelope-from ) id 1gvOrZ-000iT9-3r for gllmg-musl@m.gmane.org; Sun, 17 Feb 2019 17:00:17 +0100 Original-Received: (qmail 21625 invoked by uid 550); 17 Feb 2019 16:00:14 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 21604 invoked from network); 17 Feb 2019 16:00:14 -0000 Content-Disposition: inline In-Reply-To: <20190217155531.31d2d938@onion.lan> Original-Sender: Rich Felker Xref: news.gmane.org gmane.linux.lib.musl.general:13809 Archived-At: On Sun, Feb 17, 2019 at 03:55:31PM +0100, Peter Wagner wrote: > Hello, > > after the latest update to musl 1.1.21 this code compiles on glibc > without a problem and works. It compiles for musl too but it crashes at > the free. > > #include > #include > #include > #include > > int main(){ > int error; > const char *paddr = "192.168.1.1"; > struct addrinfo *ai = NULL; > > struct addrinfo hint = { > /* don't return duplicates */ > .ai_protocol = (int)IPPROTO_UDP, > .ai_flags = AI_NUMERICHOST, > .ai_family = AF_UNSPEC, > }; > > error = getaddrinfo(paddr, NULL, &hint, &ai); > > if ( ! error ) > { > free(ai->ai_canonname); /* crashes here*/ > } > } > > > The gdb backtrace: > > (gdb) c > Continuing. > > Program received signal SIGSEGV, Segmentation fault. > __bin_chunk (self=0x77ffffbc) at src/malloc/malloc.c:450 > 450 if (next->psize != self->csize) a_crash(); > (gdb) bt > #0 __bin_chunk (self=0x77ffffbc) at src/malloc/malloc.c:450 > #1 0x004006b0 in main () at foo.c:22 > > > The corresponding code in malloc.c: > > │449 /* Crash on corrupted footer (likely from buffer overflow) */ > │ >│450 if (next->psize != self->csize) a_crash(); > > Shouldn't it be possible to free a part of a structure instead of > freeing the addrinfo structure ai points to as a whole? No. Short of an explicit contract that you can, the assumption is that you can't. Nothing says that ai_canonname points to memory "as if obtained by malloc", or that it can be passed to free. In fact the spec even allows it to point to the same storage as the host argument. The relevant text is: "If nodename is not null, and if requested by the AI_CANONNAME flag, the ai_canonname field of the first returned addrinfo structure shall point to a null-terminated string containing the canonical name corresponding to the input nodename; if the canonical name is not available, then ai_canonname shall refer to the nodename argument or a string with the same contents." Code passing this to free is just buggy. Rich