[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20190217160001.GF23599@brightrain.aerifal.cx>
Date: Sun, 17 Feb 2019 11:00:01 -0500
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Subject: Re: Freeing the ai_canonname in the getaddrinfo directly
leads to a Segmentation fault
On Sun, Feb 17, 2019 at 03:55:31PM +0100, Peter Wagner wrote:
> Hello,
>
> after the latest update to musl 1.1.21 this code compiles on glibc
> without a problem and works. It compiles for musl too but it crashes at
> the free.
>
> #include <stdlib.h>
> #include <sys/types.h>
> #include <sys/socket.h>
> #include <netdb.h>
>
> int main(){
> int error;
> const char *paddr = "192.168.1.1";
> struct addrinfo *ai = NULL;
>
> struct addrinfo hint = {
> /* don't return duplicates */
> .ai_protocol = (int)IPPROTO_UDP,
> .ai_flags = AI_NUMERICHOST,
> .ai_family = AF_UNSPEC,
> };
>
> error = getaddrinfo(paddr, NULL, &hint, &ai);
>
> if ( ! error )
> {
> free(ai->ai_canonname); /* crashes here*/
> }
> }
>
>
> The gdb backtrace:
>
> (gdb) c
> Continuing.
>
> Program received signal SIGSEGV, Segmentation fault.
> __bin_chunk (self=0x77ffffbc) at src/malloc/malloc.c:450
> 450 if (next->psize != self->csize) a_crash();
> (gdb) bt
> #0 __bin_chunk (self=0x77ffffbc) at src/malloc/malloc.c:450
> #1 0x004006b0 in main () at foo.c:22
>
>
> The corresponding code in malloc.c:
>
> │449 /* Crash on corrupted footer (likely from buffer overflow) */
> │ >│450 if (next->psize != self->csize) a_crash();
>
> Shouldn't it be possible to free a part of a structure instead of
> freeing the addrinfo structure ai points to as a whole?
No. Short of an explicit contract that you can, the assumption is that
you can't. Nothing says that ai_canonname points to memory "as if
obtained by malloc", or that it can be passed to free. In fact the
spec even allows it to point to the same storage as the host argument.
The relevant text is:
"If nodename is not null, and if requested by the AI_CANONNAME
flag, the ai_canonname field of the first returned addrinfo
structure shall point to a null-terminated string containing the
canonical name corresponding to the input nodename; if the
canonical name is not available, then ai_canonname shall refer to
the nodename argument or a string with the same contents."
Code passing this to free is just buggy.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
