Change in libusrp[master]: usrp_prims_common: fix use-after-free in get_proto_filename()

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/gerrit-log@lists.osmocom.org/.

fixeria gerrit-no-reply at lists.osmocom.org
Sun Oct 24 21:19:30 UTC 2021


fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libusrp/+/25927 )


Change subject: usrp_prims_common: fix use-after-free in get_proto_filename()
......................................................................

usrp_prims_common: fix use-after-free in get_proto_filename()

Every time the get_proto_filename() is called, a new instance
of std::string is allocated for the first argument.  When the
function returns, this instance gets deallocated.  Therefore,
the returned user_filename.c_str() points to free()d memory.

Change-Id: Ib0007e9aebd9e77c28531c1ec70c61f1723a2d0d
Fixes: CID#240724
---
M host/lib/usrp_prims_common.cc
1 file changed, 1 insertion(+), 1 deletion(-)



  git pull ssh://gerrit.osmocom.org:29418/libusrp refs/changes/27/25927/1

diff --git a/host/lib/usrp_prims_common.cc b/host/lib/usrp_prims_common.cc
index 20a5565..ca9b447 100644
--- a/host/lib/usrp_prims_common.cc
+++ b/host/lib/usrp_prims_common.cc
@@ -85,7 +85,7 @@
 }
 
 static const char *
-get_proto_filename(const std::string user_filename, const char *env_var, const char *def)
+get_proto_filename(const std::string &user_filename, const char *env_var, const char *def)
 {
   if (user_filename.length() != 0)
     return user_filename.c_str();

-- 
To view, visit https://gerrit.osmocom.org/c/libusrp/+/25927
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: libusrp
Gerrit-Branch: master
Gerrit-Change-Id: Ib0007e9aebd9e77c28531c1ec70c61f1723a2d0d
Gerrit-Change-Number: 25927
Gerrit-PatchSet: 1
Gerrit-Owner: fixeria <vyanitskiy at sysmocom.de>
Gerrit-MessageType: newchange
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20211024/8d390f1d/attachment.htm>


More information about the gerrit-log mailing list