From: Frank Ch. Eigler Date: Wed, 19 Feb 2025 03:09:12 +0000 (-0500) Subject: debuginfod-client: correct invalid free() in failed ima path X-Git-Tag: elfutils-0.193~41 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a71bac67f4705b84368b71f5ece54deedaa1abf1;p=thirdparty%2Felfutils.git debuginfod-client: correct invalid free() in failed ima path debuginfod-find with a failed signature configuration was found on f41 glibc (2.40) to sometimes leave invalid addresses in a sscanf("%ms", &ptr) pointer in case of error, leading to an invalid free() during cleanup. We now clear that ptr manually, making valgrind happy. Unclear why this hasn't shown up in testsuite testing. ==1098106== Invalid free() / delete / delete[] / realloc() ==1098106== at 0x4844B83: free (vg_replace_malloc.c:989) ==1098106== by 0x49647A2: ??? (in /usr/lib64/libdebuginfod-0.192.so) ==1098106== by 0x401528: main (debuginfod-find.c:209) ==1098106== Address 0xc8 is not stack'd, malloc'd or (recently) free'd Signed-off-by: Frank Ch. Eigler --- diff --git a/debuginfod/debuginfod-client.c b/debuginfod/debuginfod-client.c index d89beae9..4152b06a 100644 --- a/debuginfod/debuginfod-client.c +++ b/debuginfod/debuginfod-client.c @@ -1599,6 +1599,7 @@ debuginfod_validate_imasig (debuginfod_client *c, int fd) if (!hdr_ima_sig || 1 != sscanf(hdr_ima_sig + strlen("x-debuginfod-imasignature:"), "%ms", &sig_buf)) { rc = -ENODATA; + sig_buf = NULL; // f41 glibc may litter here in case of sscanf error goto exit_validate; } if (strlen(sig_buf) > MAX_SIGNATURE_SIZE) // reject if too long