Skip to content

Commit

Permalink
sqlops: fix use-after-free by deep copying result name
Browse files Browse the repository at this point in the history
When creating a new result handle, deep copy the result name.
Otherwise we might end up accessing the name after it's freed.

(cherry picked from commit 6e26044)
  • Loading branch information
fabled committed Apr 16, 2015
1 parent c237310 commit e9fd10a
Showing 1 changed file with 5 additions and 2 deletions.
7 changes: 5 additions & 2 deletions modules/sqlops/sql_api.c
Expand Up @@ -199,14 +199,16 @@ sql_result_t* sql_get_result(str *name)
return sr;
sr = sr->next;
}
sr = (sql_result_t*)pkg_malloc(sizeof(sql_result_t));
sr = (sql_result_t*)pkg_malloc(sizeof(sql_result_t) + name->len);
if(sr==NULL)
{
LM_ERR("no pkg memory\n");
return NULL;
}
memset(sr, 0, sizeof(sql_result_t));
sr->name = *name;
memcpy(sr+1, name->s, name->len);
sr->name.s = (char *)(sr + 1);
sr->name.len = name->len;
sr->resid = resid;
sr->next = _sql_result_root;
_sql_result_root = sr;
Expand Down Expand Up @@ -665,6 +667,7 @@ void sql_destroy(void)
pkg_free(r);
r = r0;
}
_sql_result_root = NULL;
}

/**
Expand Down

0 comments on commit e9fd10a

Please sign in to comment.