diff mbox series

libasm: Fix use-after-free issue with circular single linked list cleanup

Message ID 20230217140027.125332-1-mark@klomp.org
State Committed
Headers
Series libasm: Fix use-after-free issue with circular single linked list cleanup |

Commit Message

Mark Wielaard Feb. 17, 2023, 2 p.m. UTC 
  Pointed out by gcc 12 with -Wuse-after-free=3

In function ‘free_section’
asm_end.c:552:17: error: pointer ‘data’ used after ‘free’ [-Werror=use-after-free]
  552 |     while (oldp != scnp->content);
      |            ~~~~~^~~~~~~~~~~~~~~~
asm_end.c:550:9: note: call to ‘free’ here
  550 |         free (oldp);
      |         ^~~~~~~~~~~

Fix by freeing scnp->content last.

Signed-off-by: Mark Wielaard <mark@klomp.org>
---
 libasm/ChangeLog |  4 ++++
 libasm/asm_end.c | 18 ++++++++++--------
 2 files changed, 14 insertions(+), 8 deletions(-)

Comments

Mark Wielaard Feb. 21, 2023, 12:22 p.m. UTC | #1 
Hi,

On Fri, 2023-02-17 at 15:00 +0100, Mark Wielaard wrote:
> Pointed out by gcc 12 with -Wuse-after-free=3
> 
> In function ‘free_section’
> asm_end.c:552:17: error: pointer ‘data’ used after ‘free’ [-Werror=use-after-free]
>   552 |     while (oldp != scnp->content);
>       |            ~~~~~^~~~~~~~~~~~~~~~
> asm_end.c:550:9: note: call to ‘free’ here
>   550 |         free (oldp);
>       |         ^~~~~~~~~~~
> 
> Fix by freeing scnp->content last.

I pushed this and also committed the attached patch that adds -Wuse-
after-free=3 if the compiler supports it.

Cheers,

Mark
diff mbox series

Patch

diff --git a/libasm/ChangeLog b/libasm/ChangeLog
index a12d14b3..f23d5914 100644
--- a/libasm/ChangeLog
+++ b/libasm/ChangeLog
@@ -1,3 +1,7 @@ 
+2023-02-17  Mark Wielaard  <mark@klomp.org>
+
+	* asm_end.c (free_section): free scnp->content last.
+
 2022-12-20  Mark Wielaard  <mark@klomp.org>
 
 	* disasm_begin.c: Include libeblP.h.
diff --git a/libasm/asm_end.c b/libasm/asm_end.c
index c06d2366..29165ac4 100644
--- a/libasm/asm_end.c
+++ b/libasm/asm_end.c
@@ -541,16 +541,18 @@  free_section (AsmScn_t *scnp)
   if (scnp->subnext != NULL)
     free_section (scnp->subnext);
 
+  /* This is a circular single linked list.  */
   struct AsmData *data = scnp->content;
   if (data != NULL)
-    do
-      {
-	oldp = data;
-	data = data->next;
-	free (oldp);
-      }
-    while (oldp != scnp->content);
-
+    {
+      while (data != scnp->content)
+	{
+	  oldp = data;
+	  data = data->next;
+	  free (oldp);
+	}
+      free (scnp->content);
+    }
   free (scnp);
 }