Procházet zdrojové kódy

libdpkg: Fix free() on uninitialized pointer in error_context_errmsg_format()

When erroring out inside a recursive error handler the error context
errmsg field was not initialized, which meant the a free() was being
done on a garbage pointer, crashing the program.

Regression introduced in commit 4e1e0e78412060de420d2fa7f8a24231d6eff9bb.
Guillem Jover před 10 roky
rodič
revize
678fd0b6dc
2 změnil soubory, kde provedl 3 přidání a 2 odebrání
  1. 2 0
      debian/changelog
  2. 1 2
      lib/dpkg/ehandle.c

+ 2 - 0
debian/changelog

@@ -38,6 +38,8 @@ dpkg (1.18.11) UNRELEASED; urgency=medium
     gets truncated. In case we have to use the emergency buffer because the
     gets truncated. In case we have to use the emergency buffer because the
     previous vasprintf() call failed, we should only return an error code if
     previous vasprintf() call failed, we should only return an error code if
     the vsnprintf() call on the emergency buffer truncates the output.
     the vsnprintf() call on the emergency buffer truncates the output.
+  * Fix free() on uninitialized pointer in error_context_errmsg_format() in
+    libdpkg. Regression introduced in dpkg 1.18.7. Closes: #842004
   * Architecture support:
   * Architecture support:
     - Add support for AIX operating system.
     - Add support for AIX operating system.
   * Portability:
   * Portability:

+ 1 - 2
lib/dpkg/ehandle.c

@@ -280,8 +280,7 @@ run_cleanups(struct error_context *econ, int flagsetin)
         if (setjmp(recurse_jump)) {
         if (setjmp(recurse_jump)) {
           run_cleanups(&recurserr, ehflag_bombout | ehflag_recursiveerror);
           run_cleanups(&recurserr, ehflag_bombout | ehflag_recursiveerror);
         } else {
         } else {
-          recurserr.cleanups= NULL;
-          recurserr.next= NULL;
+          memset(&recurserr, 0, sizeof(recurserr));
           set_error_printer(&recurserr, print_cleanup_error, NULL);
           set_error_printer(&recurserr, print_cleanup_error, NULL);
           set_jump_handler(&recurserr, &recurse_jump);
           set_jump_handler(&recurserr, &recurse_jump);
           econtext= &recurserr;
           econtext= &recurserr;