Bläddra i källkod

libdpkg: Fix free() on uninitialized pointer in error_context_errmsg_format()

When erroring out inside a recursive error handler the error context
errmsg field was not initialized, which meant the a free() was being
done on a garbage pointer, crashing the program.

Regression introduced in commit 4e1e0e78412060de420d2fa7f8a24231d6eff9bb.
Guillem Jover 9 år sedan
förälder
incheckning
678fd0b6dc
2 ändrade filer med 3 tillägg och 2 borttagningar
  1. 2 0
      debian/changelog
  2. 1 2
      lib/dpkg/ehandle.c

+ 2 - 0
debian/changelog

@@ -38,6 +38,8 @@ dpkg (1.18.11) UNRELEASED; urgency=medium
     gets truncated. In case we have to use the emergency buffer because the
     previous vasprintf() call failed, we should only return an error code if
     the vsnprintf() call on the emergency buffer truncates the output.
+  * Fix free() on uninitialized pointer in error_context_errmsg_format() in
+    libdpkg. Regression introduced in dpkg 1.18.7. Closes: #842004
   * Architecture support:
     - Add support for AIX operating system.
   * Portability:

+ 1 - 2
lib/dpkg/ehandle.c

@@ -280,8 +280,7 @@ run_cleanups(struct error_context *econ, int flagsetin)
         if (setjmp(recurse_jump)) {
           run_cleanups(&recurserr, ehflag_bombout | ehflag_recursiveerror);
         } else {
-          recurserr.cleanups= NULL;
-          recurserr.next= NULL;
+          memset(&recurserr, 0, sizeof(recurserr));
           set_error_printer(&recurserr, print_cleanup_error, NULL);
           set_jump_handler(&recurserr, &recurse_jump);
           econtext= &recurserr;