Skip to content

Commit

Permalink
access: fix use-after-free of struct credentials
Browse files Browse the repository at this point in the history
Func_delete() called credentials_destroy() after
func->vtab->destroy(). But appeared, that vtab->destroy() is
actually delete, and it frees the func object. Now the func's
owner credentials are destroyed before the function is freed.

Closes #4597
Follow up #2763

(cherry picked from commit 330ea24)
  • Loading branch information
Gerold103 authored and kyukhin committed Oct 31, 2019
1 parent 091ab9d commit 430cb62
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 1 deletion.
3 changes: 2 additions & 1 deletion src/box/func.c
Expand Up @@ -492,6 +492,7 @@ func_c_destroy(struct func *base)
assert(base != NULL && base->def->language == FUNC_LANGUAGE_C);
struct func_c *func = (struct func_c *) base;
func_c_unload(func);
TRASH(base);
free(func);
}

Expand Down Expand Up @@ -577,8 +578,8 @@ void
func_delete(struct func *func)
{
struct func_def *def = func->def;
func->vtab->destroy(func);
credentials_destroy(&func->owner_credentials);
func->vtab->destroy(func);
free(def);
}

Expand Down
1 change: 1 addition & 0 deletions src/box/lua/call.c
Expand Up @@ -731,6 +731,7 @@ func_lua_destroy(struct func *func)
{
assert(func != NULL && func->def->language == FUNC_LANGUAGE_LUA);
assert(func->vtab == &func_lua_vtab);
TRASH(func);
free(func);
}

Expand Down

0 comments on commit 430cb62

Please sign in to comment.