Skip to content

resolve: fix use after free in DnsAnswer#18135

Merged
mrc0mmand merged 1 commit intosystemd:masterfrom
yuwata:resolve-fix-dns-answer-18132
Jan 8, 2021
Merged

resolve: fix use after free in DnsAnswer#18135
mrc0mmand merged 1 commit intosystemd:masterfrom
yuwata:resolve-fix-dns-answer-18132

Conversation

@yuwata
Copy link
Copy Markdown
Member

@yuwata yuwata commented Jan 5, 2021

This fixes a bug introduced by ae45e1a.

Fixes #18132.

@bluca
Copy link
Copy Markdown
Member

bluca commented Jan 5, 2021

@mrc0mmand if you have a reliable reproducer, could you please check this patch, if you have time?

@mrc0mmand
Copy link
Copy Markdown
Member

@mrc0mmand if you have a reliable reproducer, could you please check this patch, if you have time?

Unfortunately I don't, this issue happened quite randomly across several runs in the past couple of days.

@poettering poettering added the reviewed/needs-rework 🔨 PR has been reviewed and needs another round of reworks label Jan 6, 2021
@yuwata yuwata force-pushed the resolve-fix-dns-answer-18132 branch from 8041cdb to 25e9a02 Compare January 8, 2021 07:50
@yuwata yuwata removed the reviewed/needs-rework 🔨 PR has been reviewed and needs another round of reworks label Jan 8, 2021
@yuwata
Copy link
Copy Markdown
Member Author

yuwata commented Jan 8, 2021

@poettering and @bluca Thank you for the review. Force-pushed a new version. PTAL.

This fixes a bug introduced by ae45e1a.

The set DnsAnswer::set_items contains the reference to the array in
DnsAnswer. So, the set must be reconstructed when we realloc() the
object.

Fixes systemd#18132.
@yuwata yuwata force-pushed the resolve-fix-dns-answer-18132 branch from 25e9a02 to b863809 Compare January 8, 2021 14:10
@yuwata
Copy link
Copy Markdown
Member Author

yuwata commented Jan 8, 2021

@poettering Thank you for your comment. The comment is updated. Setting the green label.

@yuwata yuwata added good-to-merge/waiting-for-ci 👍 PR is good to merge, but CI hasn't passed at time of review. Please merge if you see CI has passed and removed good-to-merge/with-minor-suggestions labels Jan 8, 2021
@mrc0mmand mrc0mmand merged commit 0c2c0fd into systemd:master Jan 8, 2021
@mrc0mmand mrc0mmand removed the good-to-merge/waiting-for-ci 👍 PR is good to merge, but CI hasn't passed at time of review. Please merge if you see CI has passed label Jan 8, 2021
@yuwata yuwata deleted the resolve-fix-dns-answer-18132 branch January 8, 2021 18:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

Potential heap-use-after-free in systemd-resolved

5 participants