debian/notmuch
1
0
Fork 0
mirror of https://git.notmuchmail.org/git/notmuch synced 2024-12-22 17:34:54 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

lib: fix memory error in notmuch_config_list_value

Browse source 
The documentation for notmuch_config_list_key warns that that the
returned value will be destroyed by the next call to
notmuch_config_list_key, but it neglected to mention that calling
notmuch_config_list_value would also destroy it (by calling
notmuch_config_list_key). This is surprising, and caused a use after
free bug in _setup_user_query_fields (first noticed by an OpenBSD
porter, so kudos to the OpenBSD malloc implementation).  This change
fixes that use-after-free bug.
This commit is contained in:
David Bremner 2019-11-24 22:31:34 -04:00
parent 2a003f0f50
commit 8e22514842
1 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
lib/config.cc
View file

@ -150,13 +150,17 @@ notmuch_config_list_valid (notmuch_config_list_t *metadata)
return true;
}
static inline char * _key_from_iterator (notmuch_config_list_t *list) {
return talloc_strdup (list, (*list->iterator).c_str () + CONFIG_PREFIX.length ());
}
const char *
notmuch_config_list_key (notmuch_config_list_t *list)
{
if (list->current_key)
talloc_free (list->current_key);
list->current_key = talloc_strdup (list, (*list->iterator).c_str () + CONFIG_PREFIX.length ());
list->current_key = _key_from_iterator (list);
return list->current_key;
}
@ -166,7 +170,7 @@ notmuch_config_list_value (notmuch_config_list_t *list)
{
std::string strval;
notmuch_status_t status;
const char *key = notmuch_config_list_key (list);
char *key = _key_from_iterator (list);
/* TODO: better error reporting?? */
status = _metadata_value (list->notmuch, key, strval);
@ -177,6 +181,7 @@ notmuch_config_list_value (notmuch_config_list_t *list)
talloc_free (list->current_val);
list->current_val = talloc_strdup (list, strval.c_str ());
talloc_free (key);
return list->current_val;
}