Kaynağa Gözat

libdpkg: Fix free() on uninitialized pointer in error_context_errmsg_format()

When erroring out inside a recursive error handler the error context
errmsg field was not initialized, which meant the a free() was being
done on a garbage pointer, crashing the program.

Regression introduced in commit 4e1e0e78412060de420d2fa7f8a24231d6eff9bb.
Guillem Jover 10 yıl önce
ebeveyn
işleme
678fd0b6dc
2 değiştirilmiş dosya ile 3 ekleme ve 2 silme
  1. 2 0
      debian/changelog
  2. 1 2
      lib/dpkg/ehandle.c

+ 2 - 0
debian/changelog

@@ -38,6 +38,8 @@ dpkg (1.18.11) UNRELEASED; urgency=medium
     gets truncated. In case we have to use the emergency buffer because the
     gets truncated. In case we have to use the emergency buffer because the
     previous vasprintf() call failed, we should only return an error code if
     previous vasprintf() call failed, we should only return an error code if
     the vsnprintf() call on the emergency buffer truncates the output.
     the vsnprintf() call on the emergency buffer truncates the output.
+  * Fix free() on uninitialized pointer in error_context_errmsg_format() in
+    libdpkg. Regression introduced in dpkg 1.18.7. Closes: #842004
   * Architecture support:
   * Architecture support:
     - Add support for AIX operating system.
     - Add support for AIX operating system.
   * Portability:
   * Portability:

+ 1 - 2
lib/dpkg/ehandle.c

@@ -280,8 +280,7 @@ run_cleanups(struct error_context *econ, int flagsetin)
         if (setjmp(recurse_jump)) {
         if (setjmp(recurse_jump)) {
           run_cleanups(&recurserr, ehflag_bombout | ehflag_recursiveerror);
           run_cleanups(&recurserr, ehflag_bombout | ehflag_recursiveerror);
         } else {
         } else {
-          recurserr.cleanups= NULL;
-          recurserr.next= NULL;
+          memset(&recurserr, 0, sizeof(recurserr));
           set_error_printer(&recurserr, print_cleanup_error, NULL);
           set_error_printer(&recurserr, print_cleanup_error, NULL);
           set_jump_handler(&recurserr, &recurse_jump);
           set_jump_handler(&recurserr, &recurse_jump);
           econtext= &recurserr;
           econtext= &recurserr;