Skip to content

dbfile: fix use-after-free and leak when recreating a rejected hashfile #413

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
martinus wants to merge 1 commit into
base: master
Choose a base branch
from
Open

dbfile: fix use-after-free and leak when recreating a rejected hashfile #413

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 14 additions & 3 deletions dbfile.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -257,8 +257,9 @@ static int dbfile_set_modes(sqlite3 *db)
return ret;
}

static int dbfile_prepare(sqlite3 *db)
static int dbfile_prepare(sqlite3 **db_p)
{
sqlite3 *db = *db_p;
struct dbfile_config cfg;
int ret;
char dbpath[PATH_MAX + 1];
Expand Down Expand Up @@ -306,8 +307,18 @@ static int dbfile_prepare(sqlite3 *db)
return ret;
}

/*
* Hand the freshly-opened handle back to the caller:
* dbfile_prepare took *db_p by reference precisely so this
* replacement propagates. The old handle was just closed above;
* returning it (as the by-value version did) left the caller
* using freed memory and leaking this new one.
*/
db = __dbfile_open_handle(dbpath, false);
return dbfile_prepare(db);
*db_p = db;
if (!db)
return -1;
return dbfile_prepare(db_p);
}

/* May store the default config, if fields were missing
Expand Down Expand Up @@ -359,7 +370,7 @@ static sqlite3 *__dbfile_open_handle(char *filename, bool force_create)
return NULL;
}

ret = dbfile_prepare(db);
ret = dbfile_prepare(&db);
if (ret) {
sqlite3_close(db);
return NULL;
Expand Down