d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix double free in setfacl(1). Description from the author:

Browse Source 
Initially, 'acl' (an 'acl_t *') is allocated, and its ACCESS_ACL and
DEFAULT_ACL fields are passed to the 'libc' ACL routines for subsequent
allocation. If the '-m' option (merge existing ACL with a new one) is
specified, then 'set_acl_mask()' will be called and passed one of the
two ACLs. This function, in turn, replaces this given ACL structure by
another, freshly allocated. However, the pointer in the 'acl' variable
in the caller is not updated. The caller then proceeds to free the ACL,
incurring in a double free condition.

Submitted by:	Pedro Martelletto <pedro at ambientworks.net>
Approved by:	rwatson (mentor)
This commit is contained in:
Edward Tomasz Napierala 2008-09-06 13:17:35 +00:00
parent 2647b253d7
commit 23f80af2ca
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=182813
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
bin/setfacl/setfacl.c
View File

@ -245,10 +245,13 @@ main(int argc, char *argv[])
continue;
}
if (acl_type == ACL_TYPE_ACCESS)
if (acl_type == ACL_TYPE_ACCESS) {
final_acl = acl[ACCESS_ACL];
else
acl_free(acl[DEFAULT_ACL]);
} else {
final_acl = acl[DEFAULT_ACL];
acl_free(acl[ACCESS_ACL]);
}
if (need_mask && (set_acl_mask(&final_acl) == -1)) {
warnx("failed to set ACL mask on %s", file->filename);
@ -269,8 +272,7 @@ main(int argc, char *argv[])
}
}
acl_free(acl[ACCESS_ACL]);
acl_free(acl[DEFAULT_ACL]);
acl_free(final_acl);
free(acl);
}