Hello community, here is the log from the commit of package cifs-utils for openSUSE:Factory checked in at 2019-09-20 14:46:34 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/cifs-utils (Old) and /work/SRC/openSUSE:Factory/.cifs-utils.new.7948 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "cifs-utils" Fri Sep 20 14:46:34 2019 rev:61 rq:729477 version:6.9 Changes: -------- --- /work/SRC/openSUSE:Factory/cifs-utils/cifs-utils.changes 2019-08-28 16:02:32.558790936 +0200 +++ /work/SRC/openSUSE:Factory/.cifs-utils.new.7948/cifs-utils.changes 2019-09-20 14:46:41.366960325 +0200 @@ -1,0 +2,6 @@ +Mon Sep 9 12:56:24 UTC 2019 - Aurelien Aptel <[email protected]> + +- Fix double-free in mount.cifs; (bsc#1149164). + * add 0011-fix-doublefree.patch + +------------------------------------------------------------------- New: ---- 0011-fix-doublefree.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ cifs-utils.spec ++++++ --- /var/tmp/diff_new_pack.l7Tpe7/_old 2019-09-20 14:46:42.622960075 +0200 +++ /var/tmp/diff_new_pack.l7Tpe7/_new 2019-09-20 14:46:42.626960074 +0200 @@ -42,6 +42,7 @@ Patch7: 0008-mount.cifs.c-fix-memory-leaks-in-main-func.patch Patch8: 0009-Zero-fill-the-allocated-memory-for-new-struct-cifs_n.patch Patch9: 0010-Zero-fill-the-allocated-memory-for-a-new-ACE.patch +Patch10: 0011-fix-doublefree.patch # cifs-utils 6.8 switched to python for man page generation # we need to require either py2 or py3 package @@ -128,6 +129,7 @@ %patch7 -p1 %patch8 -p1 %patch9 -p1 +%patch10 -p1 %build export CFLAGS="%{optflags} -D_GNU_SOURCE -fpie" ++++++ 0011-fix-doublefree.patch ++++++ >From [email protected] Thu Sep 5 18:49:35 2019 From: " Paulo Alcantara (SUSE) " <[email protected]> To: <[email protected]>,<[email protected]>, <[email protected]> Cc: "Aurelien Aptel" <[email protected]> Subject: [PATCH] mount.cifs: Fix double-free issue when mounting with setuid root Date: Thu, 5 Sep 2019 15:49:35 -0300 Message-Id: <[email protected]> Content-Transfer-Encoding: 8bit Content-Type: text/plain MIME-Version: 1.0 It can be easily reproduced with the following: # chmod +s `which mount.cifs` # echo "//localhost/share /mnt cifs \ users,username=foo,password=XXXX" >> /etc/fstab # su - foo $ mount /mnt free(): double free detected in tcache 2 Child process terminated abnormally. The problem was that check_fstab() already freed orgoptions pointer and then we freed it again in main() function. Fixes: bf7f48f4c7dc ("mount.cifs.c: fix memory leaks in main func") Signed-off-by: Paulo Alcantara (SUSE) <[email protected]> --- mount.cifs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/mount.cifs.c b/mount.cifs.c index 7748d54aa814..2116fc803311 100644 --- a/mount.cifs.c +++ b/mount.cifs.c @@ -247,7 +247,6 @@ check_fstab(const char *progname, const char *mountpoint, const char *devname, * set of options. We don't want to trust what the user * gave us, so just take whatever is in /etc/fstab. */ - free(*options); *options = strdup(mnt->mnt_opts); return 0; } @@ -1762,6 +1761,7 @@ assemble_mountinfo(struct parsed_mount_info *parsed_info, const char *orig_dev, char *orgoptions) { int rc; + char *newopts = NULL; rc = drop_capabilities(0); if (rc) @@ -1773,10 +1773,11 @@ assemble_mountinfo(struct parsed_mount_info *parsed_info, if (getuid()) { rc = check_fstab(thisprogram, mountpoint, orig_dev, - &orgoptions); + &newopts); if (rc) goto assemble_exit; + orgoptions = newopts; /* enable any default user mount flags */ parsed_info->flags |= CIFS_SETUID_FLAGS; } @@ -1880,6 +1881,7 @@ assemble_mountinfo(struct parsed_mount_info *parsed_info, } assemble_exit: + free(newopts); return rc; } -- 2.23.0
