diff options
| author | Paulo Alcantara (SUSE) <paulo@paulo.ac> | 2019-09-05 15:49:35 -0300 |
|---|---|---|
| committer | Pavel Shilovsky <pshilov@microsoft.com> | 2019-10-03 17:21:02 -0700 |
| commit | d7d78d7298b335e5c42567ae87b3f366e6c7f899 (patch) | |
| tree | a396005e9ea30df4ba87844527f04a55bb93ba9d | |
| parent | 5a468f3dcbea4bfbc380a3f86466b8e33bc40570 (diff) | |
| download | cifs-utils-d7d78d7298b335e5c42567ae87b3f366e6c7f899.tar.gz cifs-utils-d7d78d7298b335e5c42567ae87b3f366e6c7f899.tar.bz2 cifs-utils-d7d78d7298b335e5c42567ae87b3f366e6c7f899.zip | |
mount.cifs: Fix double-free issue when mounting with setuid root
It can be easily reproduced with the following:
# chmod +s `which mount.cifs`
# echo "//localhost/share /mnt cifs \
users,username=foo,password=XXXX" >> /etc/fstab
# su - foo
$ mount /mnt
free(): double free detected in tcache 2
Child process terminated abnormally.
The problem was that check_fstab() already freed orgoptions pointer
and then we freed it again in main() function.
Fixes: bf7f48f4c7dc ("mount.cifs.c: fix memory leaks in main func")
Signed-off-by: Paulo Alcantara (SUSE) <paulo@paulo.ac>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
| -rw-r--r-- | mount.cifs.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/mount.cifs.c b/mount.cifs.c index 7748d54..2116fc8 100644 --- a/mount.cifs.c +++ b/mount.cifs.c @@ -247,7 +247,6 @@ check_fstab(const char *progname, const char *mountpoint, const char *devname, * set of options. We don't want to trust what the user * gave us, so just take whatever is in /etc/fstab. */ - free(*options); *options = strdup(mnt->mnt_opts); return 0; } @@ -1762,6 +1761,7 @@ assemble_mountinfo(struct parsed_mount_info *parsed_info, const char *orig_dev, char *orgoptions) { int rc; + char *newopts = NULL; rc = drop_capabilities(0); if (rc) @@ -1773,10 +1773,11 @@ assemble_mountinfo(struct parsed_mount_info *parsed_info, if (getuid()) { rc = check_fstab(thisprogram, mountpoint, orig_dev, - &orgoptions); + &newopts); if (rc) goto assemble_exit; + orgoptions = newopts; /* enable any default user mount flags */ parsed_info->flags |= CIFS_SETUID_FLAGS; } @@ -1880,6 +1881,7 @@ assemble_mountinfo(struct parsed_mount_info *parsed_info, } assemble_exit: + free(newopts); return rc; } |