Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-23 23:59:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

net/dns: Prevent UAF and double free

Browse Source 
In recv_hook(), *data->addresses is freed without being set to NULL.
Since *data->addresses can be cached in dns_cache[h].addresses, this
can lead to UAF or double free if dns_cache[h].addresses is accessed
or cleared later.

The fix sets *data->addresses to NULL after freeing to avoid dangling
pointer.

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Lidong Chen authored and Daniel Kiper committed 2025-10-24 20:05:07 +02:00
1 parent cd24e25910
commit fadc94b919
1 file changed
+3
Download Patch File Download Diff File Expand all files Collapse all files
grub-core/net/dns.c
+3
View File
@@ -424,7 +424,10 @@ recv_hook (grub_net_udp_socket_t sock __attribute__ ((unused)),
grub_netbuff_free (nb); grub_netbuff_free (nb);
grub_free (redirect_save); grub_free (redirect_save);
if (!*data->naddresses) if (!*data->naddresses)
{
grub_free (*data->addresses); grub_free (*data->addresses);
*data->addresses = NULL;
}
return GRUB_ERR_NONE; return GRUB_ERR_NONE;
} }