Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 17 Feb 2019 15:55:31 +0100
From: Peter Wagner <>
Subject: Freeing the ai_canonname in the getaddrinfo directly leads to a
 Segmentation fault


after the latest update to musl 1.1.21 this code compiles on glibc
without a problem and works. It compiles for musl too but it crashes at
the free.

#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>

int main(){
        int error;
        const char *paddr = "";
        struct addrinfo *ai = NULL;

        struct addrinfo hint = {
                /* don't return duplicates */
                .ai_protocol    = (int)IPPROTO_UDP,
                .ai_flags       = AI_NUMERICHOST,
                .ai_family      = AF_UNSPEC,

        error = getaddrinfo(paddr, NULL, &hint, &ai);

        if ( ! error )
                free(ai->ai_canonname); /* crashes here*/

The gdb backtrace:

(gdb) c

Program received signal SIGSEGV, Segmentation fault.
__bin_chunk (self=0x77ffffbc) at src/malloc/malloc.c:450
450             if (next->psize != self->csize) a_crash();
(gdb) bt
#0  __bin_chunk (self=0x77ffffbc) at src/malloc/malloc.c:450
#1  0x004006b0 in main () at foo.c:22

The corresponding code in malloc.c:

   │449  /* Crash on corrupted footer (likely from buffer overflow)   */
│ >│450   if (next->psize != self->csize) a_crash(); 

Shouldn't it be possible to free a part of a structure instead of
freeing the addrinfo structure ai points to as a whole?

Peter Wagner

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.