Skip to content

Commit

Permalink
CVE-2018-10756: Fix heap-use-after-free in tr_variantWalk
Browse files Browse the repository at this point in the history
In libtransmission/variant.c, function tr_variantWalk, when the variant
stack is reallocated, a pointer to the previously allocated memory
region is kept. This address is later accessed (heap use-after-free)
while walking back down the stack, causing the application to crash.
The application can be any application which uses libtransmission, such
as transmission-daemon, transmission-gtk, transmission-show, etc.

Reported-by: Tom Richards <tom@tomrichards.net>
  • Loading branch information
mikedld committed Apr 29, 2020
1 parent a6482b0 commit 2123adf
Showing 1 changed file with 14 additions and 8 deletions.
22 changes: 14 additions & 8 deletions libtransmission/variant.c
Expand Up @@ -758,7 +758,7 @@ static int compareKeyIndex(void const* va, void const* vb)
struct SaveNode
{
tr_variant const* v;
tr_variant sorted;
tr_variant* sorted;
size_t childIndex;
bool isVisited;
};
Expand All @@ -783,30 +783,36 @@ static void nodeConstruct(struct SaveNode* node, tr_variant const* v, bool sort_

qsort(tmp, n, sizeof(struct KeyIndex), compareKeyIndex);

tr_variantInitDict(&node->sorted, n);
node->sorted = tr_new(tr_variant, 1);
tr_variantInitDict(node->sorted, n);

for (size_t i = 0; i < n; ++i)
{
node->sorted.val.l.vals[i] = *tmp[i].val;
node->sorted->val.l.vals[i] = *tmp[i].val;
}

node->sorted.val.l.count = n;
node->sorted->val.l.count = n;

tr_free(tmp);

node->v = &node->sorted;
v = node->sorted;
}
else
{
node->v = v;
node->sorted = NULL;
}

node->v = v;
}

static void nodeDestruct(struct SaveNode* node)
{
if (node->v == &node->sorted)
TR_ASSERT(node != NULL);

if (node->sorted != NULL)
{
tr_free(node->sorted.val.l.vals);
tr_free(node->sorted->val.l.vals);
tr_free(node->sorted);
}
}

Expand Down

0 comments on commit 2123adf

Please sign in to comment.