uci: fix a potential use-after-free in uci_set()

[project/uci.git] / list.c

diff --git a/list.c b/list.c
index 863c48c..25aec56 100644 (file)
--- a/list.c
+++ b/list.c
@@ -12,8 +12,9 @@
  * GNU Lesser General Public License for more details.
  */
 
-static void uci_list_set_pos(struct uci_list *head, struct uci_list *ptr, int pos)
+static bool uci_list_set_pos(struct uci_list *head, struct uci_list *ptr, int pos)
 {
+       struct uci_list *old_head = ptr->prev;
        struct uci_list *new_head = head;
        struct uci_element *p = NULL;
 
@@ -25,6 +26,8 @@ static void uci_list_set_pos(struct uci_list *head, struct uci_list *ptr, int po
        }
 
        uci_list_add(new_head->next, ptr);
+
+       return (old_head != new_head);
 }
 
 static inline void uci_list_fixup(struct uci_list *ptr)
@@ -33,7 +36,7 @@ static inline void uci_list_fixup(struct uci_list *ptr)
        ptr->next->prev = ptr;
 }
 
-/* 
+/*
  * uci_alloc_generic allocates a new uci_element with payload
  * payload is appended to the struct to save memory and reduce fragmentation
  */
@@ -144,7 +147,7 @@ static unsigned int djbhash(unsigned int hash, char *str)
 }
 
 /* fix up an unnamed section, e.g. after adding options to it */
-__private void uci_fixup_section(struct uci_context *ctx, struct uci_section *s)
+static void uci_fixup_section(struct uci_context *ctx, struct uci_section *s)
 {
        unsigned int hash = ~0;
        struct uci_element *e;
@@ -175,7 +178,7 @@ __private void uci_fixup_section(struct uci_context *ctx, struct uci_section *s)
                        break;
                }
        }
-       sprintf(buf, "cfg%02x%04x", ++s->package->n_section, hash % (1 << 16));
+       sprintf(buf, "cfg%02x%04x", s->package->n_section, hash % (1 << 16));
        s->e.name = uci_strdup(ctx, buf);
 }
 
@@ -318,7 +321,7 @@ uci_lookup_ext_section(struct uci_context *ctx, struct uci_ptr *ptr)
        else if (!uci_validate_type(name))
                goto error;
 
-       /* if the given index is negative, it specifies the section number from 
+       /* if the given index is negative, it specifies the section number from
         * the end of the list */
        if (idx < 0) {
                c = 0;
@@ -346,7 +349,7 @@ uci_lookup_ext_section(struct uci_context *ctx, struct uci_ptr *ptr)
        goto done;
 
 error:
-       e = NULL;
+       free(section);
        memset(ptr, 0, sizeof(struct uci_ptr));
        UCI_THROW(ctx, UCI_ERR_INVAL);
 done:
@@ -431,11 +434,12 @@ uci_lookup_ptr(struct uci_context *ctx, struct uci_ptr *ptr, char *str, bool ext
 complete:
        ptr->flags |= UCI_LOOKUP_COMPLETE;
 abort:
-       return 0;
+       return UCI_OK;
 
 notfound:
        UCI_THROW(ctx, UCI_ERR_NOTFOUND);
-       return 0;
+       /* not a chance here */
+       return UCI_ERR_NOTFOUND;
 }
 
 __private struct uci_element *
@@ -513,12 +517,13 @@ int uci_reorder_section(struct uci_context *ctx, struct uci_section *s, int pos)
 {
        struct uci_package *p = s->package;
        bool internal = ctx && ctx->internal;
+       bool changed = false;
        char order[32];
 
        UCI_HANDLE_ERR(ctx);
 
-       uci_list_set_pos(&s->package->sections, &s->e.list, pos);
-       if (!internal && p->has_delta) {
+       changed = uci_list_set_pos(&s->package->sections, &s->e.list, pos);
+       if (!internal && p->has_delta && changed) {
                sprintf(order, "%d", pos);
                uci_add_delta(ctx, &p->delta, UCI_CMD_REORDER, s->e.name, NULL, order);
        }
@@ -534,7 +539,8 @@ int uci_add_section(struct uci_context *ctx, struct uci_package *p, const char *
        UCI_HANDLE_ERR(ctx);
        UCI_ASSERT(ctx, p != NULL);
        s = uci_alloc_section(p, type, NULL);
-       uci_fixup_section(ctx, s);
+       if (s && s->anonymous)
+               uci_fixup_section(ctx, s);
        *res = s;
        if (!internal && p->has_delta)
                uci_add_delta(ctx, &p->delta, UCI_CMD_ADD, s->e.name, NULL, type);
@@ -693,11 +699,15 @@ int uci_set(struct uci_context *ctx, struct uci_ptr *ptr)
                ptr->s = uci_alloc_section(ptr->p, ptr->value, ptr->section);
                ptr->last = &ptr->s->e;
        } else if (ptr->o && ptr->option) { /* update option */
+               struct uci_option *o;
+
                if ((ptr->o->type == UCI_TYPE_STRING) &&
                        !strcmp(ptr->o->v.string, ptr->value))
                        return 0;
-               uci_free_option(ptr->o);
+
+               o = ptr->o;
                ptr->o = uci_alloc_option(ptr->s, ptr->option, ptr->value);
+               uci_free_option(o);
                ptr->last = &ptr->o->e;
        } else if (ptr->s && ptr->section) { /* update section */
                char *s = uci_strdup(ctx, ptr->value);