Change in libusrp[master]: usrp_prims_common: fix use-after-free in get_proto_filename()

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/gerrit-log@lists.osmocom.org/.

laforge gerrit-no-reply at lists.osmocom.org
Mon Oct 25 10:03:07 UTC 2021


laforge has submitted this change. ( https://gerrit.osmocom.org/c/libusrp/+/25927 )

Change subject: usrp_prims_common: fix use-after-free in get_proto_filename()
......................................................................

usrp_prims_common: fix use-after-free in get_proto_filename()

Every time the get_proto_filename() is called, a new instance
of std::string is allocated for the first argument.  When the
function returns, this instance gets deallocated.  Therefore,
the returned user_filename.c_str() points to free()d memory.

Change-Id: Ib0007e9aebd9e77c28531c1ec70c61f1723a2d0d
Fixes: CID#240724
---
M host/lib/usrp_prims_common.cc
1 file changed, 1 insertion(+), 1 deletion(-)

Approvals:
  Jenkins Builder: Verified
  pespin: Looks good to me, but someone else must approve
  osmith: Looks good to me, but someone else must approve
  laforge: Looks good to me, approved



diff --git a/host/lib/usrp_prims_common.cc b/host/lib/usrp_prims_common.cc
index 20a5565..ca9b447 100644
--- a/host/lib/usrp_prims_common.cc
+++ b/host/lib/usrp_prims_common.cc
@@ -85,7 +85,7 @@
 }
 
 static const char *
-get_proto_filename(const std::string user_filename, const char *env_var, const char *def)
+get_proto_filename(const std::string &user_filename, const char *env_var, const char *def)
 {
   if (user_filename.length() != 0)
     return user_filename.c_str();

-- 
To view, visit https://gerrit.osmocom.org/c/libusrp/+/25927
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: libusrp
Gerrit-Branch: master
Gerrit-Change-Id: Ib0007e9aebd9e77c28531c1ec70c61f1723a2d0d
Gerrit-Change-Number: 25927
Gerrit-PatchSet: 1
Gerrit-Owner: fixeria <vyanitskiy at sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge at osmocom.org>
Gerrit-Reviewer: osmith <osmith at sysmocom.de>
Gerrit-Reviewer: pespin <pespin at sysmocom.de>
Gerrit-MessageType: merged
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20211025/a0451679/attachment.htm>


More information about the gerrit-log mailing list