Received: by 2002:a05:6602:18e:0:0:0:0 with SMTP id m14csp4551439ioo; Tue, 31 May 2022 06:57:47 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyUkzKyZvOzKIz0NHNRgD0Sea6Ksc5cAduj7VhZ8ffvwbU/PB9f+ov9OS6IuIz/HpETWGJn X-Received: by 2002:a17:906:fb03:b0:6fe:b442:bd64 with SMTP id lz3-20020a170906fb0300b006feb442bd64mr45885131ejb.589.1654005467664; Tue, 31 May 2022 06:57:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1654005467; cv=none; d=google.com; s=arc-20160816; b=Er3KlxO0nYOdMCJsbnEDdgWM1GFrKhcK9cbZwvsrPBjW+7A/zMyyYiu7pQKrG2E4JD GxXVpZoRb/dzrsN7GiFedak6tH5GN9ZnjNNXuWa/nCQNu4w07l4mw3Fm7GLwZKFI7ciP YJyECr6t7y16hnH6hq4XSaN0k+B5B4rEyPFT/oxq03pLsHe1Wjzrx4YumRxjrYF8S7ob dDrmPgwKzjawBN0yro09d5mQava9Fdco3Fw6DoNxfq5aCUVsozVa+/y1TNF7wJG2tldc LF1WI2ZP/jIGCSb/L6UpPiZFT9pQtLXNiFSkXpoB4efPfkE+hSaLTUUS2I5RrBe5P+Do lFvg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=muStYU4wPkWAJ33av0y4KMqbultOBohjRJbqwNMPr0Y=; b=QR2HY5vYaslsU6nk7/v9JtvYclcaPr8YmLpMxyH8aT/pt49U9xMGru1arNjkCvxIxJ Vh5l1VyYtiblxwcdYH8EzGW94aNaQKUMJQ8qGFje1WFZsAcbmtc+2v/wV/qbBOPoiilR JxrVGcK4hnz3AB60rUob64B5gHsuf69XO6bGqEhj2VnK1qNaktIHZEli/jeIaXTJo4hj 6Wx1Frv5p6GCoLcGiuXVUp2DepH+OAX4l91BjVO/LT08haGFnpSN+Ow9dDY+wZr0G4Mi iEXWh7gkLMmEiM3IaevAz1FqeUwPUMyk7AM9IMLVQbTmlD9WJxjD972vuultCjDTvpKq fsvw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-bluetooth-owner@vger.kernel.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id g20-20020a056402425400b0042b4bd763a0si15694560edb.11.2022.05.31.06.57.08; Tue, 31 May 2022 06:57:47 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-bluetooth-owner@vger.kernel.org; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243038AbiEaHmS (ORCPT + 99 others); Tue, 31 May 2022 03:42:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41880 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244586AbiEaHmM (ORCPT ); Tue, 31 May 2022 03:42:12 -0400 Received: from us-smtp-delivery-44.mimecast.com (us-smtp-delivery-44.mimecast.com [207.211.30.44]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 40A3D1583F for ; Tue, 31 May 2022 00:42:11 -0700 (PDT) Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-449-uridecpLN46ZueG31aqoTw-1; Tue, 31 May 2022 03:42:06 -0400 X-MC-Unique: uridecpLN46ZueG31aqoTw-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.rdu2.redhat.com [10.11.54.7]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 8604D2809CA5; Tue, 31 May 2022 07:42:06 +0000 (UTC) Received: from localhost.localdomain.com (unknown [10.64.242.153]) by smtp.corp.redhat.com (Postfix) with ESMTP id 130801410F36; Tue, 31 May 2022 07:42:03 +0000 (UTC) From: Gopal Tiwari To: linux-bluetooth@vger.kernel.org Cc: luiz.dentz@gmail.com, gtiwari@redhat.com Subject: [Bluez V2 13/13] Fixing use_after_free in prov-db.c Date: Tue, 31 May 2022 13:11:17 +0530 Message-Id: <20220531074117.610321-14-gopalkrishna.tiwari@gmail.com> In-Reply-To: <20220531074117.610321-1-gopalkrishna.tiwari@gmail.com> References: <20220531074117.610321-1-gopalkrishna.tiwari@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 2.85 on 10.11.54.7 X-Spam-Status: No, score=-0.0 required=5.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED, FORGED_GMAIL_RCVD,FREEMAIL_FROM,NML_ADSP_CUSTOM_MED,RCVD_IN_DNSWL_LOW, SPF_HELO_NONE,SPF_SOFTFAIL,T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org From: Gopal Tiwari Following scenario happens when prov is false and we have double free as mentioned in the below bluez-5.64/tools/mesh-gatt/prov-db.c:847: freed_arg: "g_free" frees "in_str". bluez-5.64/tools/mesh-gatt/prov-db.c:867: double_free: Calling "g_free" frees pointer "in_str" which has already been freed. Signed-off-by: Gopal Tiwari --- tools/mesh-gatt/prov-db.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/mesh-gatt/prov-db.c b/tools/mesh-gatt/prov-db.c index 2fb08f799..a5b6997e0 100644 --- a/tools/mesh-gatt/prov-db.c +++ b/tools/mesh-gatt/prov-db.c @@ -859,7 +859,8 @@ bool prov_db_local_set_iv_index(uint32_t iv_index, bool update, bool prov) set_local_iv_index(jmain, iv_index, update); prov_file_write(jmain, false); - } + } else + return true; res = true; done: -- 2.26.2