From 996e16b2cb79ae3e46742285ee2728f3a166b42a Mon Sep 17 00:00:00 2001 From: Alexandru Ardelean Date: Fri, 27 Jun 2014 19:11:43 +0300 Subject: [PATCH] ubusd: replace ubusd_msg_unshare() with ubus_msg_new() to prevent invalid free-ing The realloc is problematic mostly with large packets, as the pointer changes so what eventually gets free'd is invalid. Note that ub ptr param in the call will be passed on to a ubus_msg_free(), right after ubus_msg_ref() finishes. This bug stayed hidden the same way as the bug in libubus writev_retry(). Since the write/sendmsg function can send about ~200k the ubus_msg_enqueue() call does not get triggered. --- ubusd.c | 14 +------------- 1 file changed, 1 insertion(+), 13 deletions(-) diff --git a/ubusd.c b/ubusd.c index bcc8603..8903105 100644 --- a/ubusd.c +++ b/ubusd.c @@ -29,22 +29,10 @@ #include "ubusd.h" -static struct ubus_msg_buf *ubus_msg_unshare(struct ubus_msg_buf *ub) -{ - ub = realloc(ub, sizeof(*ub) + ub->len); - if (!ub) - return NULL; - - ub->refcount = 1; - memcpy(ub + 1, ub->data, ub->len); - ub->data = (void *) (ub + 1); - return ub; -} - static struct ubus_msg_buf *ubus_msg_ref(struct ubus_msg_buf *ub) { if (ub->refcount == ~0) - return ubus_msg_unshare(ub); + return ubus_msg_new(ub->data, ub->len, false); ub->refcount++; return ub; -- 2.11.0