Re: heap-use-after-free in rpl_glob

2020-01-17 Thread Bruno Haible
Hi Paul, > It seems that your patch is incomplete, as there's a memory leak in the > unlikely case that the malloc call fails. Oops, indeed. Thanks for the review! > Something like the attached patch instead, perhaps? Hmm, this patch is freeing the same object through the variable 'dirname' on

Re: heap-use-after-free in rpl_glob

2020-01-17 Thread Paul Eggert
On 1/17/20 9:00 AM, Bruno Haible wrote: Thank you very much for this report! I expect that the fix will also need to go into glibc. Yes, thanks, I filed a bug report here: https://sourceware.org/bugzilla/show_bug.cgi?id=25414 It seems that your patch is incomplete, as there's a memory leak in

Re: heap-use-after-free in rpl_glob

2020-01-17 Thread Tim Rühsen
Hi Bruno, I can confirm that your patch doesn't trigger asan any more. Thank you ! Regards, Tim On 17.01.20 18:00, Bruno Haible wrote: > Hi Tim, > >> The continuous fuzzer at OSS-Fuzz today reported an issue in rpl_glob. >> >> To reproduce with attached C code (on Debian unstable here, same re

Re: heap-use-after-free in rpl_glob

2020-01-17 Thread Bruno Haible
Hi Tim, > The continuous fuzzer at OSS-Fuzz today reported an issue in rpl_glob. > > To reproduce with attached C code (on Debian unstable here, same result > on Ubuntu 16.04.6 docker container with clang 10): > > export CC=gcc > export CFLAGS="-O1 -g -fno-omit-frame-pointer -fsanitize=address >