musl - [PATCH] env: avoid leaving dangling pointers in __env

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1457284958-12429-1-git-send-email-amonakov@ispras.ru>
Date: Sun,  6 Mar 2016 20:22:38 +0300
From: Alexander Monakov <amonakov@...ras.ru>
To: musl@...ts.openwall.com
Cc: Alexander Monakov <amonakov@...ras.ru>
Subject: [PATCH] env: avoid leaving dangling pointers in __env_map

This is the minimal fix for __putenv leaving a pointer to freed heap
storage in __env_map array, which could later on lead to errors such
as double-free.
---
This was discovered by code inspection after Rich asked me to develop
testcases for another environment-related patch in a recent thread.
There's another known issue due to logic errors in surrounding code
(a memory leak due to putenv never freeing storage allocated by preceding
setenv), but that is planned to be addressed with a patch overhauling the
implementation.

Thanks.
Alexander

 src/env/putenv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/env/putenv.c b/src/env/putenv.c
index 4042869..7153042 100644
--- a/src/env/putenv.c
+++ b/src/env/putenv.c
@@ -30,6 +30,7 @@ int __putenv(char *s, int a)
 				}
 			} else {
 				free(__env_map[j]);
+				__env_map[j] = s;
 			}
 		}
 	}
-- 
2.1.3

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.