net/dns: Prevent UAF and double free

In recv_hook(), *data->addresses is freed without being set to NULL.
Since *data->addresses can be cached in dns_cache[h].addresses, this
can lead to UAF or double free if dns_cache[h].addresses is accessed
or cleared later.

The fix sets *data->addresses to NULL after freeing to avoid dangling
pointer.

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

diff --git a/grub-core/net/dns.c b/grub-core/net/dns.c
index f20cd6f835c4042a8b4af2af0092ba02ac648457..bef697d980890c7baa9a5847557c60f41e9dd4d3 100644 (file)
--- a/grub-core/net/dns.c
+++ b/grub-core/net/dns.c
@@ -424,7 +424,10 @@ recv_hook (grub_net_udp_socket_t sock __attribute__ ((unused)),
   grub_netbuff_free (nb);
   grub_free (redirect_save);
   if (!*data->naddresses)
-    grub_free (*data->addresses);
+    {
+      grub_free (*data->addresses);
+      *data->addresses = NULL;
+    }
   return GRUB_ERR_NONE;
 }