tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net/dns: Prevent UAF and double free

Browse Source 
In recv_hook(), *data->addresses is freed without being set to NULL.
Since *data->addresses can be cached in dns_cache[h].addresses, this
can lead to UAF or double free if dns_cache[h].addresses is accessed
or cleared later.

The fix sets *data->addresses to NULL after freeing to avoid dangling
pointer.

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Lidong Chen 2025-10-21 21:20:04 +00:00 committed by Daniel Kiper
parent cd24e25910
commit fadc94b919
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
grub-core/net/dns.c
View File

@ -424,7 +424,10 @@ recv_hook (grub_net_udp_socket_t sock __attribute__ ((unused)),
grub_netbuff_free (nb);
grub_free (redirect_save);
if (!*data->naddresses)
grub_free (*data->addresses);
{
grub_free (*data->addresses);
*data->addresses = NULL;
}
return GRUB_ERR_NONE;
}