jimzah/openafs
1
0
Fork 0
mirror of https://git.openafs.org/openafs.git synced 2025-01-18 15:00:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

OPENAFS-SA-2024-002: viced: Free ACL on acl_Internalize_pr error

Browse Source 
CVE-2024-10396

Currently, we don't free 'newACL' if acl_Internalize_pr() fails. If
acl_Internalize_pr() has already allocated 'newACL', then the memory
associated with newACL will be leaked. This can happen if parsing the
given ACL fails at any point after successfully parsing the first
couple of lines in the ACL.

Change acl_FreeACL() to make freeing a NULL acl a no-op, to make it
easier to make sure the acl has been freed.

FIXES 135445

Change-Id: I87745fa9b6285574acdd5ecb613e80fa1ea37ae8
Reviewed-on: https://gerrit.openafs.org/15909
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>
This commit is contained in:
Andrew Deason 2023-09-18 16:14:07 -05:00 committed by Benjamin Kaduk
parent e15decb318
commit f4dfc2d718
2 changed files with 18 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/libacl/aclprocs.c
View File

@ -116,6 +116,10 @@ acl_FreeACL(struct acl_accessList **acl)
/* Releases the access list defined by acl. Returns 0 always. */
struct freeListEntry *x;
if (*acl == NULL) {
return 0;
}
x = (struct freeListEntry *)
((char *)*acl - sizeof(struct freeListEntry *) - sizeof(int));
*acl = NULL;

20
src/viced/afsfileprocs.c
View File

@ -1248,16 +1248,24 @@ RXFetch_AccessList(Vnode * targetptr, Vnode * parentwhentargetnotdir,
static afs_int32
RXStore_AccessList(Vnode * targetptr, struct AFSOpaque *AccessList)
{
struct acl_accessList *newACL; /* PlaceHolder for new access list */
int code;
struct acl_accessList *newACL = NULL;
if (acl_Internalize_pr(hpr_NameToId, AccessList->AFSOpaque_val, &newACL)
!= 0)
return (EINVAL);
if ((newACL->size + 4) > VAclSize(targetptr))
return (E2BIG);
!= 0) {
code = EINVAL;
goto done;
}
if ((newACL->size + 4) > VAclSize(targetptr)) {
code = E2BIG;
goto done;
}
memcpy((char *)VVnodeACL(targetptr), (char *)newACL, (int)(newACL->size));
code = 0;
done:
acl_FreeACL(&newACL);
return (0);
return code;
} /*RXStore_AccessList */