[PATCH] notes: avoid potential use-after-free during insertion
- From
Jeff King <peff@peff.net>
- Date
- Aug 25, 2019, 07:19 UTC
- Message-ID
- <20190825071951.GC23806@sigill.intra.peff.net>
- In-Reply-To
- <20190825071035.GB23806@sigill.intra.peff.net>
On Sun, Aug 25, 2019 at 03:10:35AM -0400, Jeff King wrote:
Show 13 quoted lines
> Curiously, I think the existing case a few lines below your patch is > wrong, though: > > ret = combine_notes(&l->val_oid, > &entry->val_oid); > if (!ret && is_null_oid(&l->val_oid)) > note_tree_remove(t, tree, n, entry); > free(entry); > return ret; > > If combining the notes fails, we'll free the entry and return an error > code, and then load_subtree() will access the freed memory. I think we > could just object_oid instead.
Here's a patch. It's textually independent of yours, but I think it makes sense to apply the two on a single branch.
No test, as I didn't bother to figure out what it takes to trigger the error message, and the solution is (hopefully) an obvious improvement even if it can't be triggered in practice.
-- >8 -- Subject: [PATCH] notes: avoid potential use-after-free during insertion
The note_tree_insert() function may free the leaf_node struct we pass in (e.g., if it's a duplicate, or if it needs to be combined with an existing note).
Most callers are happy with this, as they assume that ownership of the struct is handed off. But in load_subtree(), if we see an error we'll use the handed-off struct's key_oid to generate the die() message, potentially accessing freed memory.
We can easily fix this by instead using the original oid that we copied into the leaf_node struct.
Signed-off-by: Jeff King <peff@peff.net> --- notes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/notes.c b/notes.c index 75c028b300..3477e8e554 100644 --- a/notes.c +++ b/notes.c @@ -453,17 +453,17 @@ static void load_subtree(struct notes_tree *t, struct leaf_node *subtree, l = xcalloc(1, sizeof(*l)); oidcpy(&l->key_oid, &object_oid); oidcpy(&l->val_oid, &entry.oid); if (note_tree_insert(t, node, n, l, type, combine_notes_concatenate)) die("Failed to load %s %s into notes tree " "from %s", type == PTR_TYPE_NOTE ? "note" : "subtree", - oid_to_hex(&l->key_oid), t->ref); + oid_to_hex(&object_oid), t->ref); continue; handle_non_note: /* * Determine full path for this non-note entry. The * filename is already found in entry.path, but the * directory part of the path must be deduced from the
-- 2.23.0.478.g23872bed7d