Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid double free by making a copy of the value received from libconfig9 #879

Closed
wants to merge 1 commit into from

Conversation

bootc
Copy link

@bootc bootc commented Jul 18, 2019

I've received this patch through the Debian BTS: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=925577

It looks like libconfig9 tries to free the pointer to the string, so when shairport.c frees it itself around line 1169 you end up with a double-free. On the "wrong" system this leads to a crash.

@mikebrady
Copy link
Owner

Many thanks for this. It may take a few days to check and update.

@mikebrady
Copy link
Owner

Hi Chris. I had a good look at this. The good news (?) is that there is indeed a bug there and the patch does stop the crash. The bad news is that the patch doesn't really fix the original problem, which was caused by carelessness in allocating and deallocating memory for temporary strings. So, I have fixed it (I believe) in a slightly different way and pushed out an update in the development branch. So, respectfully, I will decline this patch. Can I ask – what is the best way to respond to the original bug reporter so as to hopefully get them to test it?

@bootc
Copy link
Author

bootc commented Jul 21, 2019

Thanks Mike, I have no issue with closing this MR, but would you mind linking to the commit(s) with the fixes please? I may as well build a package to make testing easier.

@mikebrady
Copy link
Owner

Thanks again Chris. The fix is in commit 175ae0a, specifically in the file shairport.c from line 1165 to 1194.

There are a few other unrelated and essentially cosmetic changes in that commit.

@mikebrady mikebrady closed this Jul 26, 2019
@bootc bootc deleted the bts-925577 branch July 27, 2019 01:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants