Messages in this thread | | | From | Namhyung Kim <> | Date | Tue, 11 Jul 2023 10:36:59 -0700 | Subject | Re: [PATCH v2] lib subcmd: Avoid segv/use-after-free when commands aren't excluded |
| |
On Fri, Jul 7, 2023 at 4:09 PM Ian Rogers <irogers@google.com> wrote: > > The array shortening may perform unnecessary array copies. Before > commit 657a3efee43a ("lib subcmd: Avoid memory leak in exclude_cmds") > this was benign, but afterwards this could lead to a segv. > > Fixes: 657a3efee43a ("lib subcmd: Avoid memory leak in exclude_cmds") > Signed-off-by: Ian Rogers <irogers@google.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Thanks, Namhyung
> --- > tools/lib/subcmd/help.c | 18 ++++++++++++------ > 1 file changed, 12 insertions(+), 6 deletions(-) > > diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c > index 67a8d6b740ea..adfbae27dc36 100644 > --- a/tools/lib/subcmd/help.c > +++ b/tools/lib/subcmd/help.c > @@ -68,8 +68,13 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) > while (ci < cmds->cnt && ei < excludes->cnt) { > cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name); > if (cmp < 0) { > - zfree(&cmds->names[cj]); > - cmds->names[cj++] = cmds->names[ci++]; > + if (ci == cj) { > + ci++; > + cj++; > + } else { > + zfree(&cmds->names[cj]); > + cmds->names[cj++] = cmds->names[ci++]; > + } > } else if (cmp == 0) { > ci++; > ei++; > @@ -77,10 +82,11 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes) > ei++; > } > } > - > - while (ci < cmds->cnt) { > - zfree(&cmds->names[cj]); > - cmds->names[cj++] = cmds->names[ci++]; > + if (ci != cj) { > + while (ci < cmds->cnt) { > + zfree(&cmds->names[cj]); > + cmds->names[cj++] = cmds->names[ci++]; > + } > } > for (ci = cj; ci < cmds->cnt; ci++) > zfree(&cmds->names[ci]); > -- > 2.41.0.390.g38632f3daf-goog >
| |