bugConcurrent Versions System - Bugs: bug #22045, 1.11.22 - Possible double free in...

 
 

bug #22045: 1.11.22 - Possible double free in login.c

Submitted by:  Yuri Pankov <crsd>
Submitted on:  Fri 18 Jan 2008 12:33:05 PM UTC  
 
Category: Bug ReportSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Mark D. Baushke <mdb>
Open/Closed: ClosedRelease: 
Fixed Release: 1.11.23Fixed Feature Release: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 22 Jan 2008 07:16:27 PM UTC, comment #1:

The ChangeLog entry for this fix is in cvs/src/ChangeLog as:

2006-07-25 Mark D. Baushke <mdb@gnu.org>

* login.c (free_cvs_password): New function to control freeing of
the static get_cvs_passwd() returned storage.
(login): Call it.
* cvs.h (free_cvs_password): Add prototype for it.
* client.c (auth_server): Call it.
[Alter the previous NetBSD coverity cid-3404 patch.]

http://cvs.savannah.gnu.org/viewcvs/ccvs/src/ChangeLog?cvsroot=cvs&only_with_tag=cvs1-11-x-branch&r1=1.2336.2.464&r2=1.2336.2.465
http://cvs.savannah.gnu.org/viewcvs/ccvs/src/client.c?cvsroot=cvs&only_with_tag=cvs1-11-x-branch&r1=1.318.4.43&r2=1.318.4.44
http://cvs.savannah.gnu.org/viewcvs/ccvs/src/cvs.h?cvsroot=cvs&only_with_tag=cvs1-11-x-branch&r1=1.235.4.36&r2=1.235.4.37
http://cvs.savannah.gnu.org/viewcvs/ccvs/src/login.c?cvsroot=cvs&only_with_tag=cvs1-11-x-branch&r1=1.70.4.8&r2=1.70.4.9

(file #14856)

Mark D. Baushke <mdb>
Project AdministratorIn charge of this item.
Fri 18 Jan 2008 12:33:05 PM UTC, original submission:

`cvs login`:

login() -> connect_to_pserver() -> auth_server():
password = get_cvs_password ();
(get_cvs_password returns cvs_password from login.c if it's set)
...
free(password);

and, after that, in login(), cvs_password is free()'d again.

backtrace (FreeBSD):

(gdb) run login
Starting program: /usr/bin/cvs login
Logging in to :pserver:anoncvs@anoncvs.tw.freebsd.org:2401/home/ncvs
CVS password:
Assertion failed: ((run->regs_mask[elm] & (1U << bit)) == 0), function arena_run_reg_dalloc, file /usr/src/lib/libc/stdlib/malloc.c, line 2197.

Program received signal SIGABRT, Aborted.
0x00000008013f53cc in kill () at kill.S:2
2 RSYSCALL(kill)
Current language: auto; currently asm
(gdb) bt full
#0 0x00000008013f53cc in kill () at kill.S:2
No locals.
#1 0x00000008013f423b in abort () at /usr/src/lib/libc/stdlib/abort.c:65
act = {__sigaction_u = {__sa_handler = 0x90, __sa_sigaction = 0x90}, sa_flags = 8, sa_mask = {__bits = {4294967263,
4294967295, 4294967295, 4294967295}}}
#2 0x00000008013dd225 in __assert (func=0x5b19 <Error reading address 0x5b19: Bad address>,
file=0x6 <Error reading address 0x6: Bad address>, line=0, failedexpr=0x0) at /usr/src/lib/libc/gen/assert.c:54
No locals.
#3 0x0000000801383bf3 in arena_dalloc_small (arena=0x589e70, chunk=Variable "chunk" is not available.
) at /usr/src/lib/libc/stdlib/malloc.c:2197
run = (arena_run_t *) 0x601000
bin = (arena_bin_t *) 0x589fe8
size = 16
_func_ = "arena_dalloc_small"
#4 0x0000000801383ea6 in idalloc (ptr=0x6012a0) at /usr/src/lib/libc/stdlib/malloc.c:3097
chunk = (arena_chunk_t *) 0x600000
_func_ = "idalloc"
#5 0x0000000801384177 in free (ptr=0x6012a0) at /usr/src/lib/libc/stdlib/malloc.c:4571
_func_ = "free"
#6 0x0000000000429be7 in login (argc=Variable "argc" is not available.
) at /usr/src/gnu/usr.bin/cvs/cvs/../../../../contrib/cvs/src/login.c:576
typed_password = 0x601290 'Z' <repeats 64 times>
cvsroot_canonical = 0x613300 ":pserver:anoncvs@anoncvs.tw.freebsd.org:2401/home/ncvs"
#7 0x000000000042c578 in main (argc=1, argv=0x7fffffffe668)
at /usr/src/gnu/usr.bin/cvs/cvs/../../../../contrib/cvs/src/main.c:1010
n = (Node *) 0x6131c0
CVSroot_parsed = Variable "CVSroot_parsed" is not available.

Yuri Pankov <crsd>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #14856:  cid-3404.patch added by mdb (2KiB - text/x-patch - cid-3404.patch applied to CVS STABLE sources on 2006-07-26)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by mdb (Updated the item)
  • -unavailable- added by crsd (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 22 Jan 2008 07:16:27 PM UTCmdbAttached File-=>Added cid-3404.patch, #14856
      Assigned toNone=>mdb
    Tue 22 Jan 2008 06:52:22 PM UTCmdbStatusNone=>Fixed
      Open/ClosedOpen=>Closed
      Fixed ReleaseNone=>1.11.23

    Back to the top


    Powered by Savane 3.1-cleanup1