Opened 3 years ago

Closed 3 years ago

#13375 closed bug (no change required)

[PATCH] system/boot/loader/vfs.cpp: fix use after free

Reported by: mt Owned by: axeld
Priority: normal Milestone: Unscheduled
Component: System/Boot Loader Version: R1/Development
Keywords: Cc:
Blocked By: Blocking:
Has a Patch: yes Platform: All


Since Node::Close() calls Node::Release() [1], dir->directory->Close() at line 1206 [2] could delete dir->directory itself, and then dir->directory may be used after free at next line 1207.



Attachments (2)

0033-vfs.cpp-fix-use-after-free.patch (740 bytes ) - added by mt 3 years ago.
report-50f072.html (147.1 KB ) - added by mt 3 years ago.
Report by Clang Static Analyzer

Download all attachments as: .zip

Change History (4)

comment:1 by mt, 3 years ago

Has a Patch: set

by mt, 3 years ago

Attachment: report-50f072.html added

Report by Clang Static Analyzer

comment:2 by axeld, 3 years ago

Resolution: no change required
Status: newclosed

It's not a bug, though: opendir() acquires two references (in line 1170 and 1184), and closedir() loses them both again.

Thanks anyway, it's appreciated!

Note: See TracTickets for help on using tickets.