musl - Freeing the ai_canonname in the getaddrinfo directly leads to a Segmentation fault

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190217155531.31d2d938@onion.lan>
Date: Sun, 17 Feb 2019 15:55:31 +0100
From: Peter Wagner <tripolar@....at>
To: musl@...ts.openwall.com
Subject: Freeing the ai_canonname in the getaddrinfo directly leads to a
 Segmentation fault

Hello,

after the latest update to musl 1.1.21 this code compiles on glibc
without a problem and works. It compiles for musl too but it crashes at
the free.

#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>

int main(){
        int error;
        const char *paddr = "192.168.1.1";
        struct addrinfo *ai = NULL;

        struct addrinfo hint = {
                /* don't return duplicates */
                .ai_protocol    = (int)IPPROTO_UDP,
                .ai_flags       = AI_NUMERICHOST,
                .ai_family      = AF_UNSPEC,
        };

        error = getaddrinfo(paddr, NULL, &hint, &ai);

        if ( ! error )
        {
                free(ai->ai_canonname); /* crashes here*/
        }
}

The gdb backtrace:

(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
__bin_chunk (self=0x77ffffbc) at src/malloc/malloc.c:450
450             if (next->psize != self->csize) a_crash();
(gdb) bt
#0  __bin_chunk (self=0x77ffffbc) at src/malloc/malloc.c:450
#1  0x004006b0 in main () at foo.c:22

The corresponding code in malloc.c:

   │449  /* Crash on corrupted footer (likely from buffer overflow)   */
│ >│450   if (next->psize != self->csize) a_crash(); 

Shouldn't it be possible to free a part of a structure instead of
freeing the addrinfo structure ai points to as a whole?

Regards,
Peter Wagner

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.