fdo-mirrors/NetworkManager
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git synced 2025-12-27 14:00:11 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

system-settings: fix use-after-free causing crashes when hostname is empty

Browse source 
Should be returning NULL here since the actual hostname is returned in the
for() loop if the plugin supports hostnames.  But if the plugin for some
reason returns an empty string (which they aren't supposed to do) then
hostname would be left assigned to an already-freed value, which was then
returned to higher layers.

==12331== Invalid free() / delete / delete[]
==12331==    at 0x4024B3A: free (vg_replace_malloc.c:366)
==12331==    by 0x448BFC5: g_free (gmem.c:191)
==12331==    by 0x43E0E05: value_free_string (gvaluetypes.c:268)
==12331==    by 0x43DC587: g_value_unset (gvalue.c:276)
==12331==    by 0x80B297F: notify (nm-sysconfig-settings.c:229)
==12331==    by 0x43C64E7: g_cclosure_marshal_VOID__PARAM (gmarshal.c:531)
==12331==    by 0x43B78B8: g_type_class_meta_marshal (gclosure.c:878)
==12331==    by 0x43B9251: g_closure_invoke (gclosure.c:767)
==12331==    by 0x43CD239: signal_emit_unlocked_R (gsignal.c:3178)
==12331==    by 0x43CEDB3: g_signal_emit_valist (gsignal.c:2981)
==12331==    by 0x43CF255: g_signal_emit (gsignal.c:3038)
==12331==    by 0x43BD630: g_object_dispatch_properties_changed (gobject.c:801)
==12331==  Address 0x479f208 is 0 bytes inside a block of size 1 free'd
==12331==    at 0x4024B3A: free (vg_replace_malloc.c:366)
==12331==    by 0x448BFC5: g_free (gmem.c:191)
==12331==    by 0x80B1A08: nm_sysconfig_settings_get_hostname (nm-sysconfig-settings.c:280)
==12331==    by 0x80B27C7: get_property (nm-sysconfig-settings.c:1415)
==12331==    by 0x43BC707: g_object_get_property (gobject.c:935)
==12331==    by 0x80B288D: notify (nm-sysconfig-settings.c:225)
==12331==    by 0x43C64E7: g_cclosure_marshal_VOID__PARAM (gmarshal.c:531)
==12331==    by 0x43B78B8: g_type_class_meta_marshal (gclosure.c:878)
==12331==    by 0x43B9251: g_closure_invoke (gclosure.c:767)
==12331==    by 0x43CD239: signal_emit_unlocked_R (gsignal.c:3178)
==12331==    by 0x43CEDB3: g_signal_emit_valist (gsignal.c:2981)
==12331==    by 0x43CF255: g_signal_emit (gsignal.c:3038)
This commit is contained in:
Dan Williams 2010-09-24 18:25:45 -05:00
parent 596cf1a232
commit 9e2ec0b7a1
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/system-settings/nm-sysconfig-settings.c
View file

@ -259,6 +259,7 @@ get_plugin (NMSysconfigSettings *self, guint32 capability)
return NULL;
}
/* Returns an allocated string which the caller owns and must eventually free */
char *
nm_sysconfig_settings_get_hostname (NMSysconfigSettings *self)
{
@ -281,7 +282,7 @@ nm_sysconfig_settings_get_hostname (NMSysconfigSettings *self)
}
}
return hostname;
return NULL;
}
static void