bugConcurrent Versions System - Bugs: bug #22045, 1.11.22 - Possible double free in...

 
 

bug #22045: 1.11.22 - Possible double free in login.c

Submitter:  Yuri Pankov <crsd>
Submitted:  Fri 18 Jan 2008 12:33:05 PM UTC
   
 
Category:  Bug Report Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  mdb
Open/Closed:  Closed Release: 
Fixed Release:  1.11.23 Fixed Feature Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 22 Jan 2008 07:16:27 PM UTC, comment #1: 

The ChangeLog entry for this fix is in cvs/src/ChangeLog as:

2006-07-25  Mark D. Baushke  <mdb@gnu.org>

        * login.c (free_cvs_password): New function to control freeing of
        the static get_cvs_passwd() returned storage.
        (login): Call it.
        * cvs.h (free_cvs_password): Add prototype for it.
        * client.c (auth_server): Call it.
        [Alter the previous NetBSD coverity cid-3404 patch.]

http://cvs.savannah.gnu.org/viewcvs/ccvs/src/ChangeLog?cvsroot=cvs&only_with_tag=cvs1-11-x-branch&r1=1.2336.2.464&r2=1.2336.2.465
http://cvs.savannah.gnu.org/viewcvs/ccvs/src/client.c?cvsroot=cvs&only_with_tag=cvs1-11-x-branch&r1=1.318.4.43&r2=1.318.4.44
http://cvs.savannah.gnu.org/viewcvs/ccvs/src/cvs.h?cvsroot=cvs&only_with_tag=cvs1-11-x-branch&r1=1.235.4.36&r2=1.235.4.37
http://cvs.savannah.gnu.org/viewcvs/ccvs/src/login.c?cvsroot=cvs&only_with_tag=cvs1-11-x-branch&r1=1.70.4.8&r2=1.70.4.9


(file #14856)

Mark D. Baushke <mdb>
Group administrator
Fri 18 Jan 2008 12:33:05 PM UTC, original submission:  

`cvs login`:

login() -> connect_to_pserver() -> auth_server():
password = get_cvs_password ();
(get_cvs_password returns cvs_password from login.c if it's set)
...
free(password);

and, after that, in login(), cvs_password is free()'d again.

backtrace (FreeBSD):

(gdb) run login
Starting program: /usr/bin/cvs login
Logging in to :pserver:anoncvs@anoncvs.tw.freebsd.org:2401/home/ncvs
CVS password:
Assertion failed: ((run->regs_mask[elm] & (1U << bit)) == 0), function arena_run_reg_dalloc, file /usr/src/lib/libc/stdlib/malloc.c, line 2197.

Program received signal SIGABRT, Aborted.
0x00000008013f53cc in kill () at kill.S:2
2       RSYSCALL(kill)
Current language:  auto; currently asm
(gdb) bt full
#0  0x00000008013f53cc in kill () at kill.S:2
No locals.
#1  0x00000008013f423b in abort () at /usr/src/lib/libc/stdlib/abort.c:65
        act = {__sigaction_u = {__sa_handler = 0x90, __sa_sigaction = 0x90}, sa_flags = 8, sa_mask = {__bits = {4294967263,
      4294967295, 4294967295, 4294967295}}}
#2  0x00000008013dd225 in __assert (func=0x5b19 <Error reading address 0x5b19: Bad address>,
    file=0x6 <Error reading address 0x6: Bad address>, line=0, failedexpr=0x0) at /usr/src/lib/libc/gen/assert.c:54
No locals.
#3  0x0000000801383bf3 in arena_dalloc_small (arena=0x589e70, chunk=Variable "chunk" is not available.
) at /usr/src/lib/libc/stdlib/malloc.c:2197
        run = (arena_run_t *) 0x601000
        bin = (arena_bin_t *) 0x589fe8
        size = 16
        _func_ = "arena_dalloc_small"
#4  0x0000000801383ea6 in idalloc (ptr=0x6012a0) at /usr/src/lib/libc/stdlib/malloc.c:3097
        chunk = (arena_chunk_t *) 0x600000
        _func_ = "idalloc"
#5  0x0000000801384177 in free (ptr=0x6012a0) at /usr/src/lib/libc/stdlib/malloc.c:4571
        _func_ = "free"
#6  0x0000000000429be7 in login (argc=Variable "argc" is not available.
) at /usr/src/gnu/usr.bin/cvs/cvs/../../../../contrib/cvs/src/login.c:576
        typed_password = 0x601290 'Z' <repeats 64 times>
        cvsroot_canonical = 0x613300 ":pserver:anoncvs@anoncvs.tw.freebsd.org:2401/home/ncvs"
#7  0x000000000042c578 in main (argc=1, argv=0x7fffffffe668)
    at /usr/src/gnu/usr.bin/cvs/cvs/../../../../contrib/cvs/src/main.c:1010
        n = (Node *) 0x6131c0
        CVSroot_parsed = Variable "CVSroot_parsed" is not available.

Yuri Pankov <crsd>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #14856:  cid-3404.patch added by mdb (2KiB - text/x-patch - cid-3404.patch applied to CVS STABLE sources on 2006-07-26)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mdb (Updated the item)
  • -email is unavailable- added by crsd (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2008-01-22 mdb Attached File- Added cid-3404.patch, #14856
        Assigned toNone mdb
    2008-01-22 mdb StatusNone Fixed
        Open/ClosedOpen Closed
        Fixed ReleaseNone 1.11.23

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code