Date: Mon, 4 Jan 2016 08:42:09 +0100 From: Markus Wichmann <nullplan@....net> To: musl@...ts.openwall.com Subject: Re: [PATCH] fix use of pointer after free in unsetenv On Mon, Jan 04, 2016 at 02:09:44AM +0300, Alexander Cherepanov wrote: > Hi! > > The code in  uses a pointer which was freed and hence has an > indeterminate value. Patch attached. > >  http://git.musl-libc.org/cgit/musl/tree/src/env/unsetenv.c#n23 > What are you talking about? free() ends the lifetime of the object pointed to by the argument given. However, after the free() only the pointer itself is used. It won't be dereferenced again, and instead will be immediately overwritten with a valid pointer. And while it is possible that the pointer becomes so invalid that even loading it causes undefined behavior, this doesn't happen on any of the supported systems (it might happen on i386 with segmentation, but Linux/i386, which is the only supported OS for musl, doesn't use segmentation). So it looks like unnecessary complexity to me to apply this patch. Ciao, Markus
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.