[OpenWrt-Devel] [PATCH 5/7] ubusd: replace ubusd_msg_unshare() with ubus_msg_new() to prevent invalid free-ing

[Alexandru Ardelean]

The realloc is problematic mostly with large packets, as the pointer changes
so what eventually gets free'd is invalid.
Note that ub ptr param in the  call will be passed on to a ubus_msg_free(),
right after ubus_msg_ref() finishes.

This bug stayed hidden the same way as the bug in libubus writev_retry().
Since the write/sendmsg function can send about ~200k the ubus_msg_enqueue()
call does not get triggered.

---
 ubusd.c | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/ubusd.c b/ubusd.c
index bcc8603..8903105 100644
--- a/ubusd.c
+++ b/ubusd.c
@@ -29,22 +29,10 @@
 
 #include "ubusd.h"
 
-static struct ubus_msg_buf *ubus_msg_unshare(struct ubus_msg_buf *ub)
-{
-	ub = realloc(ub, sizeof(*ub) + ub->len);
-	if (!ub)
-		return NULL;
-
-	ub->refcount = 1;
-	memcpy(ub + 1, ub->data, ub->len);
-	ub->data = (void *) (ub + 1);
-	return ub;
-}
-
 static struct ubus_msg_buf *ubus_msg_ref(struct ubus_msg_buf *ub)
 {
 	if (ub->refcount == ~0)
-		return ubus_msg_unshare(ub);
+		return ubus_msg_new(ub->data, ub->len, false);
 
 	ub->refcount++;
 	return ub;
-- 
1.8.4.5
_______________________________________________
openwrt-devel mailing list
openwrt-devel at lists.openwrt.org
https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel