EljakimHerrewijnen/Openwrt
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

opkg: fix use-after-free with duplicate packages on the command line

Browse Source 
When the same package file is specified multiple times on the opkg install
command line, the name pointer on the argv array becomes stale after the
package structures have been merged, leading to invalid memory accesses
upon install.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
This commit is contained in:
Jo-Philipp Wich 2016-04-23 14:03:50 +02:00
parent b9466382b5
commit 4c60a6f803
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
package/system/opkg/Makefile
View File

@ -1,5 +1,6 @@
#
# Copyright (C) 2006-2015 OpenWrt.org
# Copyright (C) 2016 LEDE Project
#
# This is free software, licensed under the GNU General Public License v2.
# See /LICENSE for more information.
@ -12,7 +13,7 @@ include $(INCLUDE_DIR)/feeds.mk
PKG_NAME:=opkg
PKG_REV:=9c97d5ecd795709c8584e972bfdf3aee3a5b846d
PKG_VERSION:=$(PKG_REV)
PKG_RELEASE:=12
PKG_RELEASE:=13
PKG_SOURCE_PROTO:=git
PKG_SOURCE_VERSION:=$(PKG_REV)

11
package/system/opkg/patches/270-fix-use-after-free.patch Normal file
View File

@ -0,0 +1,11 @@
--- a/libopkg/opkg_download.c
+++ b/libopkg/opkg_download.c
@@ -335,7 +335,7 @@ opkg_prepare_url_for_install(const char
hash_insert_pkg(pkg, 1);
if (namep) {
- *namep = pkg->name;
+ *namep = xstrdup(pkg->name);
}
return 0;
}