Double-free vulnerability in contrib/shpsort.c

[eldstal]

Summary

The buffer copy is freed twice, leading to possible memory corruption or vulnerability.

Cause

In split(), at shpsort.c:107, the buffer copy is free'd. realloc() fails on line 110, the buffer copy is freed again at shpsort.c:116.

Impact

A double-free bug can lead to an attacker gaining control over the values returned from malloc(), which in turn may allow both disclosure of sensitive data (e.g. bypassing additional safety features) or in the worst case hostile code execution.

Vulnerable version

• contrib/shpsort (commit 21ae8fc)

Proposed mitigation

Remove line 116, as it is redundant.

[mloskot]

Instead of opening the issue, a pull request could be a time saver

[eldstal]

Fair point.

[eldstal]

This vulnerability has been assigned CVE-2022-0699 by the Red Hat CNA.