Page MenuHomeFreeBSD

Fix use-after-free error in nscd (CID 1006083)
Needs ReviewPublic

Authored by truckman on Jun 7 2016, 11:29 PM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Nov 21, 2:35 PM
Unknown Object (File)
Fri, Nov 21, 1:37 AM
Unknown Object (File)
Oct 23 2025, 11:58 PM
Unknown Object (File)
Oct 23 2025, 12:41 PM
Unknown Object (File)
Oct 20 2025, 1:04 AM
Unknown Object (File)
Oct 20 2025, 1:03 AM
Unknown Object (File)
Oct 19 2025, 11:04 AM
Unknown Object (File)
Oct 18 2025, 9:30 AM
Subscribers

Details

Reviewers
jhb
se
des
Summary

Coverity flagged a use-after-free error in the nscd cache_read
function. It noticed that find_res->value is getting freed
before it gets passed to memcpy(). It looks like the problem
is a missing return (-1) inside the

	    if (find_res->fifo_policy_item->last_request_time.tv_sec -
	        find_res->fifo_policy_item->creation_time.tv_sec
	        common_entry->common_params.max_lifetime.tv_sec) {

block.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 4141
Build 4184: arc lint + arc unit

Event Timeline

truckman retitled this revision from to Fix use-after-free error in nscd (CID 1006083).
truckman updated this object.
truckman edited the test plan for this revision. (Show Details)
truckman added reviewers: jhb, se, des.