Issue 8200 - Potential use of freed data after mdb_midl_shrink()
Summary: Potential use of freed data after mdb_midl_shrink()
Status: VERIFIED FIXED
Alias: None
Product: OpenLDAP
Classification: Unclassified
Component: slapd (show other issues)
Version: unspecified
Hardware: All All
: --- normal
Target Milestone: ---
Assignee: OpenLDAP project
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-07-14 17:53 UTC by Hallvard Furuseth
Modified: 2015-08-18 17:41 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this issue.
Description Hallvard Furuseth 2015-07-14 17:53:59 UTC 
Full_Name: Hallvard B Furuseth
Version: LMDB_0.9.15
OS: 
URL: 
Submission from: (NULL) (81.191.45.5)
Submitted by: hallvard


This code is wrong if the realloc in mdb_midl_shrink fails:

	if (mdb_midl_shrink(&txn->mt_free_pgs))
		env->me_free_pgs = txn->mt_free_pgs;

env->me_free_pgs is left pointing as an old, freed IDL.
(Freed when mt_free_pgs was originally grown.)
It should be:

	mdb_midl_shrink(&txn->mt_free_pgs);
	env->me_free_pgs = txn->mt_free_pgs;

So mdb_midl_shrink() can return void.
Comment 1 Hallvard Furuseth 2015-07-20 17:50:37 UTC 
changed notes
changed state Open to Test
moved from Incoming to Software Bugs
Comment 2 OpenLDAP project 2015-07-28 14:17:07 UTC 
fixed in mdb.master, mdb.RE/0.9, master
Comment 3 Howard Chu 2015-07-28 14:17:07 UTC 
changed notes
Comment 4 Quanah Gibson-Mount 2015-07-28 16:07:10 UTC 
changed state Test to Release
Comment 5 Quanah Gibson-Mount 2015-08-18 17:41:57 UTC 
changed state Release to Closed