Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 4 Jan 2016 08:42:09 +0100
From: Markus Wichmann <>
Subject: Re: [PATCH] fix use of pointer after free in unsetenv

On Mon, Jan 04, 2016 at 02:09:44AM +0300, Alexander Cherepanov wrote:
> Hi!
> The code in [1] uses a pointer which was freed and hence has an
> indeterminate value. Patch attached.
> [1]

What are you talking about? free() ends the lifetime of the object
pointed to by the argument given. However, after the free() only the
pointer itself is used. It won't be dereferenced again, and instead will
be immediately overwritten with a valid pointer. And while it is
possible that the pointer becomes so invalid that even loading it causes
undefined behavior, this doesn't happen on any of the supported systems
(it might happen on i386 with segmentation, but Linux/i386, which is the
only supported OS for musl, doesn't use segmentation).

So it looks like unnecessary complexity to me to apply this patch.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.