|
 |
8a5747 |
From 110713ae423173168a417f1dde6af1c322cb958a Mon Sep 17 00:00:00 2001
|
|
|
8a5747 |
From: Liping Zhang <zlpnobody@gmail.com>
|
|
|
8a5747 |
Date: Sun, 19 Mar 2017 22:01:10 +0800
|
|
|
8a5747 |
Subject: [PATCH] examples: fix double free in nftc-helper-add
|
|
|
8a5747 |
|
|
|
8a5747 |
After inputting the following test command, core dump happened:
|
|
|
8a5747 |
# ./examples/nfct-helper-add test 1
|
|
|
8a5747 |
*** Error in
|
|
|
8a5747 |
`.../libnetfilter_cthelper/examples/.libs/lt-nfct-helper-add':
|
|
|
8a5747 |
double free or corruption (fasttop): 0x0000000001f3c070 ***
|
|
|
8a5747 |
======= Backtrace: =========
|
|
|
8a5747 |
/lib64/libc.so.6(+0x77de5)[0x7fd9ebe88de5]
|
|
|
8a5747 |
/lib64/libc.so.6(+0x8022a)[0x7fd9ebe9122a]
|
|
|
8a5747 |
/lib64/libc.so.6(cfree+0x4c)[0x7fd9ebe9478c]
|
|
|
8a5747 |
[...]
|
|
|
8a5747 |
|
|
|
8a5747 |
Because "struct nfct_helper_policy *p" had been freed by nfct_helper_free,
|
|
|
8a5747 |
so there's no need to invoke nfct_helper_policy_free again, otherwise
|
|
|
8a5747 |
double free error will happen.
|
|
|
8a5747 |
|
|
|
8a5747 |
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
|
|
|
8a5747 |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
8a5747 |
(cherry picked from commit 9f223e612d3b0be6e4dca84e1db8042dbec64e93)
|
|
|
8a5747 |
---
|
|
|
8a5747 |
examples/nfct-helper-add.c | 2 +-
|
|
|
8a5747 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
8a5747 |
|
|
|
8a5747 |
diff --git a/examples/nfct-helper-add.c b/examples/nfct-helper-add.c
|
|
|
8a5747 |
index 6c476261b75e8..cb7291e8ec4b0 100644
|
|
|
8a5747 |
--- a/examples/nfct-helper-add.c
|
|
|
8a5747 |
+++ b/examples/nfct-helper-add.c
|
|
|
8a5747 |
@@ -32,6 +32,7 @@ int main(int argc, char *argv[])
|
|
|
8a5747 |
nfct_helper_attr_set_u16(nfct_helper, NFCTH_ATTR_PROTO_L3NUM, AF_INET);
|
|
|
8a5747 |
nfct_helper_attr_set_u8(nfct_helper, NFCTH_ATTR_PROTO_L4NUM, IPPROTO_TCP);
|
|
|
8a5747 |
|
|
|
8a5747 |
+ /* Will be freed by nfct_helper_free. */
|
|
|
8a5747 |
p = nfct_helper_policy_alloc();
|
|
|
8a5747 |
if (p == NULL) {
|
|
|
8a5747 |
perror("OOM");
|
|
|
8a5747 |
@@ -49,7 +50,6 @@ int main(int argc, char *argv[])
|
|
|
8a5747 |
nfct_helper_nlmsg_build_payload(nlh, nfct_helper);
|
|
|
8a5747 |
|
|
|
8a5747 |
nfct_helper_free(nfct_helper);
|
|
|
8a5747 |
- nfct_helper_policy_free(p);
|
|
|
8a5747 |
|
|
|
8a5747 |
nl = mnl_socket_open(NETLINK_NETFILTER);
|
|
|
8a5747 |
if (nl == NULL) {
|
|
|
8a5747 |
--
|
|
|
8a5747 |
2.34.1
|
|
|
8a5747 |
|