From a71bac67f4705b84368b71f5ece54deedaa1abf1 Mon Sep 17 00:00:00 2001 From: "Frank Ch. Eigler" Date: Tue, 18 Feb 2025 22:09:12 -0500 Subject: [PATCH] debuginfod-client: correct invalid free() in failed ima path debuginfod-find with a failed signature configuration was found on f41 glibc (2.40) to sometimes leave invalid addresses in a sscanf("%ms", &ptr) pointer in case of error, leading to an invalid free() during cleanup. We now clear that ptr manually, making valgrind happy. Unclear why this hasn't shown up in testsuite testing. ==1098106== Invalid free() / delete / delete[] / realloc() ==1098106== at 0x4844B83: free (vg_replace_malloc.c:989) ==1098106== by 0x49647A2: ??? (in /usr/lib64/libdebuginfod-0.192.so) ==1098106== by 0x401528: main (debuginfod-find.c:209) ==1098106== Address 0xc8 is not stack'd, malloc'd or (recently) free'd Signed-off-by: Frank Ch. Eigler --- debuginfod/debuginfod-client.c | 1 + 1 file changed, 1 insertion(+) diff --git a/debuginfod/debuginfod-client.c b/debuginfod/debuginfod-client.c index d89beae9..4152b06a 100644 --- a/debuginfod/debuginfod-client.c +++ b/debuginfod/debuginfod-client.c @@ -1599,6 +1599,7 @@ debuginfod_validate_imasig (debuginfod_client *c, int fd) if (!hdr_ima_sig || 1 != sscanf(hdr_ima_sig + strlen("x-debuginfod-imasignature:"), "%ms", &sig_buf)) { rc = -ENODATA; + sig_buf = NULL; // f41 glibc may litter here in case of sscanf error goto exit_validate; } if (strlen(sig_buf) > MAX_SIGNATURE_SIZE) // reject if too long -- 2.47.2