openwrt/270-fix-use-after-free.patch at 06fca0c48bb84285432a6ee7aa0cda54fe5b20c4 - openwrt - Gitea

ExternalVendorCode/openwrt

mirror of https://github.com/openwrt/openwrt.git synced 2024-12-23 15:32:33 +00:00

Jo-Philipp Wich 4c60a6f803 opkg: fix use-after-free with duplicate packages on the command line

When the same package file is specified multiple times on the opkg install
command line, the name pointer on the argv array becomes stale after the
package structures have been merged, leading to invalid memory accesses
upon install.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

2016-04-23 14:03:50 +02:00

12 lines

256 B

Diff

Raw Blame History

 --- a/libopkg/opkg_download.c
 +++ b/libopkg/opkg_download.c
@@ -335,7 +335,7 @@ opkg_prepare_url_for_install(const char
       hash_insert_pkg(pkg, 1);
       if (namep) {
 -	  *namep = pkg->name;
 +	  *namep = xstrdup(pkg->name);
       }
       return 0;
  }