diff options
Diffstat (limited to 'main/kamailio/sqlops-fix-use-after-free-by-deep-copying-result-nam.patch')
| -rw-r--r-- | main/kamailio/sqlops-fix-use-after-free-by-deep-copying-result-nam.patch | 45 |
1 files changed, 0 insertions, 45 deletions
diff --git a/main/kamailio/sqlops-fix-use-after-free-by-deep-copying-result-nam.patch b/main/kamailio/sqlops-fix-use-after-free-by-deep-copying-result-nam.patch deleted file mode 100644 index 593afab03c..0000000000 --- a/main/kamailio/sqlops-fix-use-after-free-by-deep-copying-result-nam.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 6e2604464e64cfaaf1e0327228f53f4787b69470 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi> -Date: Mon, 9 Mar 2015 16:30:53 +0200 -Subject: [PATCH] sqlops: fix use-after-free by deep copying result name - -When creating a new result handle, deep copy the result name. -Otherwise we might end up accessing the name after it's freed. ---- - modules/sqlops/sql_api.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/modules/sqlops/sql_api.c b/modules/sqlops/sql_api.c -index cf0efee..db87fbf 100644 ---- a/modules/sqlops/sql_api.c -+++ b/modules/sqlops/sql_api.c -@@ -197,14 +197,16 @@ sql_result_t* sql_get_result(str *name) - return sr; - sr = sr->next; - } -- sr = (sql_result_t*)pkg_malloc(sizeof(sql_result_t)); -+ sr = (sql_result_t*)pkg_malloc(sizeof(sql_result_t) + name->len); - if(sr==NULL) - { - LM_ERR("no pkg memory\n"); - return NULL; - } - memset(sr, 0, sizeof(sql_result_t)); -- sr->name = *name; -+ memcpy(sr+1, name->s, name->len); -+ sr->name.s = (char *)(sr + 1); -+ sr->name.len = name->len; - sr->resid = resid; - sr->next = _sql_result_root; - _sql_result_root = sr; -@@ -683,6 +685,7 @@ void sql_destroy(void) - pkg_free(r); - r = r0; - } -+ _sql_result_root = NULL; - } - - /** --- -2.3.5 - |