From: Jo-Philipp Wich Date: Tue, 29 Oct 2019 07:28:17 +0000 (+0100) Subject: uci: reset uci_ptr flags when merging set operations X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=abbc3020dcfb6ed7dcbcf8eaf27e17a8fc9df83c;p=oweals%2Frpcd.git uci: reset uci_ptr flags when merging set operations In some cases, e.g. when subsequently setting multiple empty option values, uci_set() might free the section pointer of the given reused uci_ptr structure without zeroing it, leading to a use-after-free on processing subsequent options. Avoid this issue by clearing the lookup pointer flags in order to prevent uci_set() from incorrectly branching into a uci_delete() operation leading to the freeing of the section member. Ref: http://lists.infradead.org/pipermail/openwrt-devel/2019-October/019592.html Reported-by: Daniel Danzberger Suggested-by: Yousong Zhou Signed-off-by: Jo-Philipp Wich (cherry picked from commit bd0ed2521476c3e5b6c1a0e0bd2c386ea809d74b) --- diff --git a/uci.c b/uci.c index 1587a19..0de6f3e 100644 --- a/uci.c +++ b/uci.c @@ -817,6 +817,7 @@ rpc_uci_merge_set(struct blob_attr *opt, struct uci_ptr *ptr) struct blob_attr *cur; int rem, rv; + ptr->flags = 0; ptr->o = NULL; ptr->option = blobmsg_name(opt); ptr->value = NULL;