<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"> <html lang="en"> <head> <meta content="text/html; charset=US-ASCII" http-equiv="Content-Type"> <title> GitLab </title> <style>img { max-width: 100%; height: auto; } </style> </head> <body> <div class="content"> <h3> Samuel Thibault pushed to branch master at <a href="https://gitlab.freedesktop.org/slirp/libslirp">slirp / libslirp</a> </h3> <h4> Commits: </h4> <ul> <li> <a href="https://gitlab.freedesktop.org/slirp/libslirp/-/commit/e61e18f0d5d7bb20eb081d0159b184a89f64eba9">e61e18f0</a> <div> by Brett Nash at 2022-02-11T19:21:32+01:00 </div> <pre class="commit-message" style="white-space: pre-wrap; margin: 0;">slirp: Don't duplicate packet in tcp_reass When debug is enabled, we duplicate the packet in tcp_reass, but ti is still pointing to the old buffer, resulting in a use after free. This makes valgrind debugging a little trickier, but makes it crash a lot less. Signed-off-by: Brett Nash <nash@fb.com> </pre> </li> </ul> <h4>1 changed file:</h4> <ul> <li class="file-stats"> <a href="#5d443314c4eb29a3b4c282a150da2b5f066ddcdf"> src/tcp_input.c </a> </li> </ul> <h4>Changes:</h4> <li id="5d443314c4eb29a3b4c282a150da2b5f066ddcdf"> <a href="https://gitlab.freedesktop.org/slirp/libslirp/-/commit/e61e18f0d5d7bb20eb081d0159b184a89f64eba9#5d443314c4eb29a3b4c282a150da2b5f066ddcdf">src/tcp_input.c</a> <hr> <table class="code white" style="font-family: monospace; font-size: 90%;" bgcolor="#fff" width="100%" cellpadding="0" cellspacing="0"> <tr class="line_holder match" style="line-height: 1.6;"> <td class="diff-line-num unfold js-unfold old_line" data-linenumber="82" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">...</td> <td class="diff-line-num unfold js-unfold new_line" data-linenumber="82" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa">...</td> <td class="line_content match" style="padding-left: 0.5em; padding-right: 0.5em; color: rgba(0,0,0,0.3);" bgcolor="#fafafa">@@ -82,9 +82,6 @@ static void tcp_xmit_timer(register struct tcpcb *tp, int rtt);</td> </tr> <tr class="line_holder" style="line-height: 1.6;"> <td class="old_line diff-line-num" data-linenumber="82" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa"> 82 </td> <td class="new_line diff-line-num" data-linenumber="82" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa"> 82 </td> <td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> static int tcp_reass(register struct tcpcb *tp, register struct tcpiphdr *ti, </pre></td> </tr> <tr class="line_holder" style="line-height: 1.6;"> <td class="old_line diff-line-num" data-linenumber="83" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa"> 83 </td> <td class="new_line diff-line-num" data-linenumber="83" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa"> 83 </td> <td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> struct mbuf *m) </pre></td> </tr> <tr class="line_holder" style="line-height: 1.6;"> <td class="old_line diff-line-num" data-linenumber="84" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa"> 84 </td> <td class="new_line diff-line-num" data-linenumber="84" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa"> 84 </td> <td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> { </pre></td> </tr> <tr class="line_holder old" style="line-height: 1.6;"> <td class="old_line diff-line-num old" data-linenumber="85" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc"> 85 </td> <td class="new_line diff-line-num old" data-linenumber="85" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc"> </td> <td class="line_content old" style="padding-left: 0.5em; padding-right: 0.5em;" bgcolor="#fbe9eb"><pre style="margin: 0;">- if (m) </pre></td> </tr> <tr class="line_holder old" style="line-height: 1.6;"> <td class="old_line diff-line-num old" data-linenumber="86" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc"> 86 </td> <td class="new_line diff-line-num old" data-linenumber="85" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc"> </td> <td class="line_content old" style="padding-left: 0.5em; padding-right: 0.5em;" bgcolor="#fbe9eb"><pre style="margin: 0;">- M_DUP_DEBUG(m->slirp, m, 0, 0); </pre></td> </tr> <tr class="line_holder old" style="line-height: 1.6;"> <td class="old_line diff-line-num old" data-linenumber="87" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc"> 87 </td> <td class="new_line diff-line-num old" data-linenumber="85" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #fac5cd; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#f9d7dc"> </td> <td class="line_content old" style="padding-left: 0.5em; padding-right: 0.5em;" bgcolor="#fbe9eb"><pre style="margin: 0;">- </pre></td> </tr> <tr class="line_holder" style="line-height: 1.6;"> <td class="old_line diff-line-num" data-linenumber="88" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa"> 88 </td> <td class="new_line diff-line-num" data-linenumber="85" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa"> 85 </td> <td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> register struct tcpiphdr *q; </pre></td> </tr> <tr class="line_holder" style="line-height: 1.6;"> <td class="old_line diff-line-num" data-linenumber="89" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa"> 89 </td> <td class="new_line diff-line-num" data-linenumber="86" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa"> 86 </td> <td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> struct socket *so = tp->t_socket; </pre></td> </tr> <tr class="line_holder" style="line-height: 1.6;"> <td class="old_line diff-line-num" data-linenumber="90" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa"> 90 </td> <td class="new_line diff-line-num" data-linenumber="87" style="width: 35px; color: rgba(0,0,0,0.3); border-right-width: 1px; border-right-color: #f0f0f0; border-right-style: solid; padding: 0 5px;" align="right" bgcolor="#fafafa"> 87 </td> <td class="line_content" style="padding-left: 0.5em; padding-right: 0.5em;"><pre style="margin: 0;"> int flags; </pre></td> </tr> </table> </li> </div> <div class="footer" style="margin-top: 10px;"> — <a href="https://gitlab.freedesktop.org/slirp/libslirp/-/commit/e61e18f0d5d7bb20eb081d0159b184a89f64eba9">View it on GitLab</a>. You're receiving this email because of your account on gitlab.freedesktop.org. If you'd like to receive fewer emails, you can adjust your notification settings. <script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Commit","url":"https://gitlab.freedesktop.org/slirp/libslirp/-/commit/e61e18f0d5d7bb20eb081d0159b184a89f64eba9"}}</script> </div> </body> </html>