Project

General

Profile

Actions

Bug #4545

closed

_t_create(): Use after free in error code paths

Added by Marcel Telka over 8 years ago. Updated over 7 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
lib - userland libraries
Start date:
2014-01-29
Due date:
% Done:

100%

Estimated time:
Difficulty:
Medium
Tags:
needs-triage
Gerrit CR:

Description

There is this code in the _t_create() function:

961    ntiptr = add_tilink(fd);
962    if (ntiptr == NULL) {
963        t_errno = TSYSERR;
964        errno = ENOMEM;
965        return (NULL);
966    }
967    sig_mutex_lock(&ntiptr->ti_lock);
968
969    /*
970     * Allocate buffers for the new descriptor
971     */
972    if (_t_alloc_bufs(fd, ntiptr, tiap) < 0) {
973        sv_errno = errno;
974        (void) _t_delete_tilink(fd);
975        t_errno = TSYSERR;
976        sig_mutex_unlock(&ntiptr->ti_lock);
977        errno = sv_errno;
978        return (NULL);
979    }

The ntiptr is allocated at line 961 in add_tilink() and freed at line 974 via _t_delete_tilink(). However, at line 976 the freed memory is referenced.

Similar error handling code is in the _t_create() used several times.


Files

test.c (172 Bytes) test.c Marcel Telka, 2015-02-10 11:45 PM
test.d (709 Bytes) test.d Marcel Telka, 2015-02-10 11:45 PM

Related issues

Related to illumos gate - Bug #4871: t_sync(3nsl) is not thread safeIn ProgressMarcel Telka2014-05-20

Actions
Actions

Also available in: Atom PDF