This is the mail archive of the
binutils@sourceware.org
mailing list for the binutils project.
[PATCH 2/4] libctf: fix use-after-free in function dumping
- From: Nick Alcock <nick dot alcock at oracle dot com>
- To: binutils at sourceware dot org
- Cc: jose dot marchesi at oracle dot com, John dot W dot Marshall at glasgow dot ac dot uk, sebastian dot huber at embedded-brains dot de, nickc at redhat dot com
- Date: Tue, 4 Jun 2019 16:23:50 +0100
- Subject: [PATCH 2/4] libctf: fix use-after-free in function dumping
- References: <20190604152352.149585-1-nick.alcock@oracle.com>
This is actually a free-before-initializing (i.e. a free of garbage).
libctf/
* ctf-dump.c (ctf_dump_funcs): Free in the right place.
---
libctf/ChangeLog | 4 ++++
libctf/ctf-dump.c | 2 +-
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/libctf/ChangeLog b/libctf/ChangeLog
index d059d58d19..01b8d8da24 100644
--- a/libctf/ChangeLog
+++ b/libctf/ChangeLog
@@ -1,3 +1,7 @@
+2019-06-03 Nick Alcock <nick.alcock@oracle.com>
+
+ * ctf-dump.c (ctf_dump_funcs): Free in the right place.
+
2019-05-29 Nick Alcock <nick.alcock@oracle.com>
* Makefile.am (ZLIB): New.
diff --git a/libctf/ctf-dump.c b/libctf/ctf-dump.c
index c2ed791eea..82f63c29d0 100644
--- a/libctf/ctf-dump.c
+++ b/libctf/ctf-dump.c
@@ -273,7 +273,6 @@ ctf_dump_funcs (ctf_file_t *fp, ctf_dump_state_t *state)
goto err;
str = ctf_str_append (str, " ");
- free (bit);
/* Function name. */
@@ -290,6 +289,7 @@ ctf_dump_funcs (ctf_file_t *fp, ctf_dump_state_t *state)
}
str = ctf_str_append (str, bit);
str = ctf_str_append (str, " (");
+ free (bit);
/* Function arguments. */
--
2.21.0.237.gd0cfaa883d