From e8d83732f9eb571dce71aa915ff38a072579610b Mon Sep 17 00:00:00 2001 From: Luka Koznjak Date: Wed, 4 Dec 2019 21:36:34 +0100 Subject: [PATCH] file: fix segfault in uci_parse_option MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Fixed a segmentation fault caused by using a pointer to a reallocated address. The name pointer in the uci_parse_option function becomes invalid if assert_eol calls uci_realloc down the line, resulting in a segmentation fault when attempting to dereference name in a strcmp check in uci_lookup_list. A simple fix is to call assert_eol before retrieving the actual address for the name and type pointers. The segmentation fault has been found while fuzzing the uci configuration system for various types of different crashes and undefined behavious, which resulted in multiple different import files causing instability and sementation faults. Signed-off-by: Luka Kožnjak Signed-off-by: Juraj Vijtiuk CC: Luka Perkov --- file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/file.c b/file.c index 3cd7702..3ac49c6 100644 --- a/file.c +++ b/file.c @@ -471,9 +471,9 @@ static void uci_parse_option(struct uci_context *ctx, bool list) ofs_name = next_arg(ctx, true, true, false); ofs_value = next_arg(ctx, false, false, false); + assert_eol(ctx); name = pctx_str(pctx, ofs_name); value = pctx_str(pctx, ofs_value); - assert_eol(ctx); uci_fill_ptr(ctx, &ptr, &pctx->section->e); e = uci_lookup_list(&pctx->section->options, name); -- 2.30.2