blob: 593afab03cafafb349baa9c49cc51840432e66bf (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
From 6e2604464e64cfaaf1e0327228f53f4787b69470 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Mon, 9 Mar 2015 16:30:53 +0200
Subject: [PATCH] sqlops: fix use-after-free by deep copying result name
When creating a new result handle, deep copy the result name.
Otherwise we might end up accessing the name after it's freed.
---
modules/sqlops/sql_api.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/modules/sqlops/sql_api.c b/modules/sqlops/sql_api.c
index cf0efee..db87fbf 100644
--- a/modules/sqlops/sql_api.c
+++ b/modules/sqlops/sql_api.c
@@ -197,14 +197,16 @@ sql_result_t* sql_get_result(str *name)
return sr;
sr = sr->next;
}
- sr = (sql_result_t*)pkg_malloc(sizeof(sql_result_t));
+ sr = (sql_result_t*)pkg_malloc(sizeof(sql_result_t) + name->len);
if(sr==NULL)
{
LM_ERR("no pkg memory\n");
return NULL;
}
memset(sr, 0, sizeof(sql_result_t));
- sr->name = *name;
+ memcpy(sr+1, name->s, name->len);
+ sr->name.s = (char *)(sr + 1);
+ sr->name.len = name->len;
sr->resid = resid;
sr->next = _sql_result_root;
_sql_result_root = sr;
@@ -683,6 +685,7 @@ void sql_destroy(void)
pkg_free(r);
r = r0;
}
+ _sql_result_root = NULL;
}
/**
--
2.3.5
|
