diff options
Diffstat (limited to 'main/kamailio/sqlops-fix-use-after-free-by-deep-copying-result-nam.patch')
| -rw-r--r-- | main/kamailio/sqlops-fix-use-after-free-by-deep-copying-result-nam.patch | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/main/kamailio/sqlops-fix-use-after-free-by-deep-copying-result-nam.patch b/main/kamailio/sqlops-fix-use-after-free-by-deep-copying-result-nam.patch new file mode 100644 index 0000000000..593afab03c --- /dev/null +++ b/main/kamailio/sqlops-fix-use-after-free-by-deep-copying-result-nam.patch @@ -0,0 +1,45 @@ +From 6e2604464e64cfaaf1e0327228f53f4787b69470 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi> +Date: Mon, 9 Mar 2015 16:30:53 +0200 +Subject: [PATCH] sqlops: fix use-after-free by deep copying result name + +When creating a new result handle, deep copy the result name. +Otherwise we might end up accessing the name after it's freed. +--- + modules/sqlops/sql_api.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/modules/sqlops/sql_api.c b/modules/sqlops/sql_api.c +index cf0efee..db87fbf 100644 +--- a/modules/sqlops/sql_api.c ++++ b/modules/sqlops/sql_api.c +@@ -197,14 +197,16 @@ sql_result_t* sql_get_result(str *name) + return sr; + sr = sr->next; + } +- sr = (sql_result_t*)pkg_malloc(sizeof(sql_result_t)); ++ sr = (sql_result_t*)pkg_malloc(sizeof(sql_result_t) + name->len); + if(sr==NULL) + { + LM_ERR("no pkg memory\n"); + return NULL; + } + memset(sr, 0, sizeof(sql_result_t)); +- sr->name = *name; ++ memcpy(sr+1, name->s, name->len); ++ sr->name.s = (char *)(sr + 1); ++ sr->name.len = name->len; + sr->resid = resid; + sr->next = _sql_result_root; + _sql_result_root = sr; +@@ -683,6 +685,7 @@ void sql_destroy(void) + pkg_free(r); + r = r0; + } ++ _sql_result_root = NULL; + } + + /** +-- +2.3.5 + |