| Summary: | unsafe use of malloc | ||
|---|---|---|---|
| Product: | [Retired] Corosync Cluster Engine | Reporter: | Fabio Massimo Di Nitto <fdinitto> |
| Component: | confdb | Assignee: | Jan Friesse <jfriesse> |
| Status: | CLOSED EOL | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | 1.3 | CC: | agk, fdinitto, jfriesse |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-03-27 19:11:08 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
Another problem found by Fabio: uid_determine and gid_determine in corosync (flatiron) use a malloc but you don't check for errors there |
static int object_key_get ( hdb_handle_t object_handle, const void *key_name, size_t key_len, void **value, size_t *value_len) { objdb_value_types_t t; int ret; char *key_name_str = (char*)key_name; char *key_name_terminated = NULL; if (key_name_str[key_len-1] != '\0') { key_name_terminated = malloc (key_len + 1); memcpy (key_name_terminated, key_name, key_len); key_name_terminated[key_len] = '\0'; key_name_str = key_name_terminated; } ret = object_key_get_typed(object_handle, key_name_str, value, value_len, &t); if (key_name_terminated) { free (key_name_terminated); } return ret; } the malloc return is not checked and it could possibly leads to crash instead of returning graceful error.... tho you are doomed anyway if that malloc fails.. :)