This is the mail archive of the libc-hacker@sources.redhat.com mailing list for the glibc project.
Note that libc-hacker is a closed list. You may look at the archives of this list, but subscription and posting are not open.
Index Nav: | [Date Index] [Subject Index] [Author Index] [Thread Index] | |
---|---|---|
Message Nav: | [Date Prev] [Date Next] | [Thread Prev] [Thread Next] |
Other format: | [Raw text] |
Hi! By saving address of pml_next we actually did not help ourselves at all, next still points into freed memory after xdr_reference and thus cannot be read nor written. The patch in bugzilla doesn't help much, it adds to a read from freed memory in xdr_reference also a write into freed memory. 2004-06-14 Jakub Jelinek <jakub@redhat.com> [BZ #218] * sunrpc/pmap_prot2.c (xdr_pmaplist): When freeing, remember pml_next in a local variable, point rp to that local variable afterwards. --- libc/sunrpc/pmap_prot2.c.jj 2002-02-26 02:43:56.000000000 +0100 +++ libc/sunrpc/pmap_prot2.c 2004-06-14 15:01:45.489088043 +0200 @@ -93,7 +93,7 @@ xdr_pmaplist (xdrs, rp) */ bool_t more_elements; int freeing = (xdrs->x_op == XDR_FREE); - struct pmaplist **next = NULL; + struct pmaplist *next = NULL; while (TRUE) { @@ -108,12 +108,12 @@ xdr_pmaplist (xdrs, rp) * before we free the current object ... */ if (freeing) - next = &((*rp)->pml_next); + next = (*rp)->pml_next; if (!INTUSE(xdr_reference) (xdrs, (caddr_t *) rp, (u_int) sizeof (struct pmaplist), (xdrproc_t) INTUSE(xdr_pmap))) return FALSE; - rp = freeing ? next : &((*rp)->pml_next); + rp = freeing ? &next : &((*rp)->pml_next); } } INTDEF(xdr_pmaplist) Jakub
Index Nav: | [Date Index] [Subject Index] [Author Index] [Thread Index] | |
---|---|---|
Message Nav: | [Date Prev] [Date Next] | [Thread Prev] [Thread Next] |