bugDatabase-driven manual pager suite - Bugs: bug #45854, Use-after-free in function...


bug #45854: Use-after-free in function ult_src()

Submitted by:  None
Submitted on:  Tue 01 Sep 2015 11:46:50 AM UTC  
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Colin Watson <cjwatson>
Open/Closed: Closed

Add a New Comment(Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Wed 09 Sep 2015 02:55:43 PM UTC, comment #2:

Thanks for this report. I've committed a fix:


Feel free to apply for a CVE if you think it warrants it; I'm not sure how exploitable this category of bug tends to be.

Colin Watson <cjwatson>
Project AdministratorIn charge of this item.
Tue 01 Sep 2015 11:51:32 AM UTC, comment #1:

Just FYI, this bug came from me, I created it without being logged in.

Hanno Boeck <hanno>
Tue 01 Sep 2015 11:46:50 AM UTC, original submission:

The mandb tool will generate use-after-free errors in certain situations in the function ult_src().
It can be tested by having a broken man file structure where one file links to another and that links to a nonexistent file. Place attached files a.1 and b.1 into /usr/share/man/man1/ and run
mandb -f /usr/share/man/man1/a.1

Using either valgrind or address sanitizer will show the uaf error. It is happening in this code path (line 376ff):
base = find_include (name, path, include);

I'm not exactly sure why this is happening, but it seems in certain situations name and base contain the same memory address. Therefore freeing base will cause name to be an invalid pointer, therefore causing a use-after-free.

I have attached the debugging output from both valgrind and address sanitizer.



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):

Attached Files
file #34783:  a.1 added by None (13B - application/octet-stream)
file #34784:  mandb-uaf-asan.txt added by None (4KiB - text/plain)
file #34785:  b.1 added by None (13B - application/octet-stream)
file #34786:  mandb-uaf-valgrind.txt added by None (12KiB - text/plain)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by cjwatson (Posted a comment)
  • -unavailable- added by hanno (Posted a comment)
  • -unavailable- added by hanno

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 09 Sep 2015 02:55:43 PM UTCcjwatsonStatusNone=>Fixed
      Assigned toNone=>cjwatson
    Tue 01 Sep 2015 11:51:32 AM UTChannoCarbon-Copy-=>Added hanno
    Tue 01 Sep 2015 11:46:50 AM UTCNoneAttached File-=>Added a.1, #34783
      Attached File-=>Added mandb-uaf-asan.txt, #34784
      Attached File-=>Added b.1, #34785
      Attached File-=>Added mandb-uaf-valgrind.txt, #34786

    Back to the top

    Powered by Savane 3.1-cleanup1