forked from rpms/glibc
0bc968985e
This is an automated DistroBaker update from upstream sources. If you do not know what this is about or would like to opt out, contact the OSCI team. Source: https://src.fedoraproject.org/rpms/glibc.git#df07cd507e60fb1effac0d28d1bb0137235725ee
41 lines
1.4 KiB
Diff
41 lines
1.4 KiB
Diff
commit a151f2e05a64727c552a297d129b8ef242ffb3b6
|
|
Author: DJ Delorie <dj@redhat.com>
|
|
Date: Thu Feb 25 16:08:21 2021 -0500
|
|
|
|
nscd: Fix double free in netgroupcache [BZ #27462]
|
|
|
|
In commit 745664bd798ec8fd50438605948eea594179fba1 a use-after-free
|
|
was fixed, but this led to an occasional double-free. This patch
|
|
tracks the "live" allocation better.
|
|
|
|
Tested manually by a third party.
|
|
|
|
Related: RHBZ 1927877
|
|
|
|
Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
|
|
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
|
|
(cherry picked from commit dca565886b5e8bd7966e15f0ca42ee5cff686673)
|
|
|
|
diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c
|
|
index dba6ceec1be490bf..ad2daddafdc9d80c 100644
|
|
--- a/nscd/netgroupcache.c
|
|
+++ b/nscd/netgroupcache.c
|
|
@@ -248,7 +248,7 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req,
|
|
: NULL);
|
|
ndomain = (ndomain ? newbuf + ndomaindiff
|
|
: NULL);
|
|
- buffer = newbuf;
|
|
+ *tofreep = buffer = newbuf;
|
|
}
|
|
|
|
nhost = memcpy (buffer + bufused,
|
|
@@ -319,7 +319,7 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req,
|
|
else if (status == NSS_STATUS_TRYAGAIN && e == ERANGE)
|
|
{
|
|
buflen *= 2;
|
|
- buffer = xrealloc (buffer, buflen);
|
|
+ *tofreep = buffer = xrealloc (buffer, buflen);
|
|
}
|
|
else if (status == NSS_STATUS_RETURN
|
|
|| status == NSS_STATUS_NOTFOUND
|