From: DJ Delorie Date: Thu, 25 Feb 2021 21:08:21 +0000 (-0500) Subject: nscd: Fix double free in netgroupcache [BZ #27462] X-Git-Tag: glibc-2.34~885 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dca565886b5e8bd7966e15f0ca42ee5cff686673;p=thirdparty%2Fglibc.git nscd: Fix double free in netgroupcache [BZ #27462] In commit 745664bd798ec8fd50438605948eea594179fba1 a use-after-free was fixed, but this led to an occasional double-free. This patch tracks the "live" allocation better. Tested manually by a third party. Related: RHBZ 1927877 Reviewed-by: Siddhesh Poyarekar Reviewed-by: Carlos O'Donell --- diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c index dba6ceec1be..ad2daddafdc 100644 --- a/nscd/netgroupcache.c +++ b/nscd/netgroupcache.c @@ -248,7 +248,7 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req, : NULL); ndomain = (ndomain ? newbuf + ndomaindiff : NULL); - buffer = newbuf; + *tofreep = buffer = newbuf; } nhost = memcpy (buffer + bufused, @@ -319,7 +319,7 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req, else if (status == NSS_STATUS_TRYAGAIN && e == ERANGE) { buflen *= 2; - buffer = xrealloc (buffer, buflen); + *tofreep = buffer = xrealloc (buffer, buflen); } else if (status == NSS_STATUS_RETURN || status == NSS_STATUS_NOTFOUND