lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 13 Feb 2022 10:24:43 -0800 From: Kees Cook <keescook@...omium.org> To: Josh Poimboeuf <jpoimboe@...hat.com> Cc: Kees Cook <keescook@...omium.org>, Valdis Klētnieks <valdis.kletnieks@...edu>, Arnaldo Carvalho de Melo <acme@...hat.com>, "Justin Forbes" <jmforbes@...uxtx.org>, linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org Subject: [PATCH v2] tools: Fix use-after-free for realloc(..., 0) GCC 12 was correctly reporting a potential use-after-free condition in the xrealloc helper. Fix the warning by avoiding an implicit "free(ptr)" when size == 0: In file included from help.c:12: In function 'xrealloc', inlined from 'add_cmdname' at help.c:24:2: subcmd-util.h:56:23: error: pointer may be used after 'realloc' [-Werror=use-after-free] 56 | ret = realloc(ptr, size); | ^~~~~~~~~~~~~~~~~~ subcmd-util.h:52:21: note: call to 'realloc' here 52 | void *ret = realloc(ptr, size); | ^~~~~~~~~~~~~~~~~~ subcmd-util.h:58:31: error: pointer may be used after 'realloc' [-Werror=use-after-free] 58 | ret = realloc(ptr, 1); | ^~~~~~~~~~~~~~~ subcmd-util.h:52:21: note: call to 'realloc' here 52 | void *ret = realloc(ptr, size); | ^~~~~~~~~~~~~~~~~~ Reported-by: "Valdis Klētnieks" <valdis.kletnieks@...edu> Fixes: 2f4ce5ec1d44 ("perf tools: Finalize subcmd independence") Cc: Josh Poimboeuf <jpoimboe@...hat.com> Signed-off-by: Kees Cook <keescook@...omium.org> --- v1: https://lore.kernel.org/lkml/20220212181855.3460176-1-keescook@chromium.org/ v2: simplify logic (josh) --- tools/lib/subcmd/subcmd-util.h | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/tools/lib/subcmd/subcmd-util.h b/tools/lib/subcmd/subcmd-util.h index 794a375dad36..b2aec04fce8f 100644 --- a/tools/lib/subcmd/subcmd-util.h +++ b/tools/lib/subcmd/subcmd-util.h @@ -50,15 +50,8 @@ static NORETURN inline void die(const char *err, ...) static inline void *xrealloc(void *ptr, size_t size) { void *ret = realloc(ptr, size); - if (!ret && !size) - ret = realloc(ptr, 1); - if (!ret) { - ret = realloc(ptr, size); - if (!ret && !size) - ret = realloc(ptr, 1); - if (!ret) - die("Out of memory, realloc failed"); - } + if (!ret) + die("Out of memory, realloc failed"); return ret; } -- 2.30.2
Powered by blists - more mailing lists