diff options
| author | Timo Teräs <timo.teras@iki.fi> | 2015-04-16 10:04:16 +0000 |
|---|---|---|
| committer | Timo Teräs <timo.teras@iki.fi> | 2015-04-16 10:04:16 +0000 |
| commit | ad4b1c67c43d9e059d3cd52a3dd6e56842ff2523 (patch) | |
| tree | ae09e13bbf5c0a361956fbf4a81febf8c3162626 /main/kamailio | |
| parent | a7bb2cd664838bcb2b975a81eb609f71c477f3b5 (diff) | |
| download | aports-ad4b1c67c43d9e059d3cd52a3dd6e56842ff2523.tar.bz2 aports-ad4b1c67c43d9e059d3cd52a3dd6e56842ff2523.tar.xz | |
main/kamailio: fix sqlops related crash
Diffstat (limited to 'main/kamailio')
| -rw-r--r-- | main/kamailio/APKBUILD | 6 | ||||
| -rw-r--r-- | main/kamailio/sqlops-fix-use-after-free-by-deep-copying-result-nam.patch | 45 |
2 files changed, 50 insertions, 1 deletions
diff --git a/main/kamailio/APKBUILD b/main/kamailio/APKBUILD index a8d787086..b7021be01 100644 --- a/main/kamailio/APKBUILD +++ b/main/kamailio/APKBUILD @@ -13,7 +13,7 @@ _gittag=HEAD pkgver=4.2.4 -pkgrel=0 +pkgrel=1 [ -z "${_gitcommit}" ] && _suffix="_src" || _suffix="-${_gitcommit}" pkgdesc="Open Source SIP Server" @@ -226,6 +226,7 @@ source="http://www.kamailio.org/pub/kamailio/$pkgver/src/kamailio-${pkgver}${_su kamailio-4.2-backslash.patch 0001-musl-fixes.patch kamailio-4.2-ipops-srv-query.patch + sqlops-fix-use-after-free-by-deep-copying-result-nam.patch DMQ-multi-notify.patch default_ctl.patch kamctl_build.patch @@ -495,6 +496,7 @@ md5sums="6c10bc5c4c727bf2bddc8a37ef3f9ae6 kamailio-4.2.4_src.tar.gz bad1ac2d4c95043df271d2ea6d37627a kamailio-4.2-backslash.patch 4685288dc54680597b00f956dc95d4d6 0001-musl-fixes.patch e9c0ba8192a1a4f2a08a2e2add20e3d7 kamailio-4.2-ipops-srv-query.patch +c76507d21eef8091756a74153fc68994 sqlops-fix-use-after-free-by-deep-copying-result-nam.patch 7df723eb9e14df28adfff8643d99a1a9 DMQ-multi-notify.patch 841fa62c432c5d8aeb57ad70d2ec3030 default_ctl.patch d0052e6054884b9cec955af4480c7c85 kamctl_build.patch @@ -504,6 +506,7 @@ sha256sums="6cc16f8d8759f555f836371780f9a9de087a09e14a1468c07dbe50dcf03c884d ka d7e59be721ed0ad4621d404493b9a519708d801e9d4914b0164b819fa1abcd13 kamailio-4.2-backslash.patch b98555ff304b51b82c6cf7e01d757b15ea4f05bd2e603c84d4384df6a6be62b6 0001-musl-fixes.patch 7e33c95bdb942e4ed6d54e14476cad2ee7edfc256b1f250e5f133d9e8a9b2a67 kamailio-4.2-ipops-srv-query.patch +1182e3af5b771aa027caa0c1f6c4195532b51b8fcd274621593fcd086d4d2a58 sqlops-fix-use-after-free-by-deep-copying-result-nam.patch 384eeaa5b253228341dc7a74ec61314db4b8f2f1c9c2f3bdf9ba189d2d56911d DMQ-multi-notify.patch 755efa4ad126c672bc67c53268260b57f7da1f454cdc1a1601778ed7c7d5f0e5 default_ctl.patch e00eefed792acbc1ee6eca8fa7389f9973bd53b68fa7abc573f19f1ff26812a1 kamctl_build.patch @@ -513,6 +516,7 @@ sha512sums="2bf899cbfef54703e0a704567ea3bd4ff2dfd6e03116bbd880460fea017691cbe958 a9bb1e8f9f373264b8351ddae099a36a46ddd46fdec09e468d297ba4f64bb4896e7d6e599da70a424e8a28695ab3f3b4ac940afab534593a6b9d08ae462f001a kamailio-4.2-backslash.patch dea7ef2ccf01357576045ba375d41301e2447b4454324007c7ca1862322835c57045852017192ca5434b32dd1b7a2e9669209b7111889dab335b74f042d0f11f 0001-musl-fixes.patch b5c048b6e06de0c7514c14d0ec99bbe939eaa956d9d9d3dd5f48b1bcbcff06dbd6498d384427253fb655997a10ec5fa31dcc5cfd2f8cc5c64dcd531649133781 kamailio-4.2-ipops-srv-query.patch +284a13873cf7cf4ae4c1d90c757974ef634863bdde146d4af9feb86e4d96e07a694c299189e8acef838246637dcf36199ac386cecfc4871cefe64b71aa6278b3 sqlops-fix-use-after-free-by-deep-copying-result-nam.patch 7ddf6444c15f7338e7aab779ea5b75f4fd936b51cf5d9ba0d09e813566e527f74e59e100661d2b27db99e5fa042614c83e8145e999a8b6bfcfab71c9595bb626 DMQ-multi-notify.patch 2321d8afe29b53057ce21e0552dfb80fd6a0e7dc0caf3c4798a8b253518f4c8c546797302933373f4b055a4531329a36ee2d7117b0a88fe39cf153bfef91a656 default_ctl.patch 4c2c9bde3a4c44feca2863bb03cb031aa55e1c3df21dc7c0acb3a392c34cb36d9a132bcbdf451a0624f8ec202152f1cf238c89280c32f1c04312ce80427a18c6 kamctl_build.patch diff --git a/main/kamailio/sqlops-fix-use-after-free-by-deep-copying-result-nam.patch b/main/kamailio/sqlops-fix-use-after-free-by-deep-copying-result-nam.patch new file mode 100644 index 000000000..593afab03 --- /dev/null +++ b/main/kamailio/sqlops-fix-use-after-free-by-deep-copying-result-nam.patch @@ -0,0 +1,45 @@ +From 6e2604464e64cfaaf1e0327228f53f4787b69470 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi> +Date: Mon, 9 Mar 2015 16:30:53 +0200 +Subject: [PATCH] sqlops: fix use-after-free by deep copying result name + +When creating a new result handle, deep copy the result name. +Otherwise we might end up accessing the name after it's freed. +--- + modules/sqlops/sql_api.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/modules/sqlops/sql_api.c b/modules/sqlops/sql_api.c +index cf0efee..db87fbf 100644 +--- a/modules/sqlops/sql_api.c ++++ b/modules/sqlops/sql_api.c +@@ -197,14 +197,16 @@ sql_result_t* sql_get_result(str *name) + return sr; + sr = sr->next; + } +- sr = (sql_result_t*)pkg_malloc(sizeof(sql_result_t)); ++ sr = (sql_result_t*)pkg_malloc(sizeof(sql_result_t) + name->len); + if(sr==NULL) + { + LM_ERR("no pkg memory\n"); + return NULL; + } + memset(sr, 0, sizeof(sql_result_t)); +- sr->name = *name; ++ memcpy(sr+1, name->s, name->len); ++ sr->name.s = (char *)(sr + 1); ++ sr->name.len = name->len; + sr->resid = resid; + sr->next = _sql_result_root; + _sql_result_root = sr; +@@ -683,6 +685,7 @@ void sql_destroy(void) + pkg_free(r); + r = r0; + } ++ _sql_result_root = NULL; + } + + /** +-- +2.3.5 + |