|
 |
63354d5 |
From 85b687098bcedb67285ab787b8bd506d328c34e0 Mon Sep 17 00:00:00 2001
|
|
|
63354d5 |
From: Ernestas Kulik <ekulik@redhat.com>
|
|
|
63354d5 |
Date: Tue, 25 Aug 2020 15:17:54 +0300
|
|
|
63354d5 |
Subject: [PATCH] gui-wizard-gtk: wizard: Fix invalid memory read
|
|
|
63354d5 |
MIME-Version: 1.0
|
|
|
63354d5 |
Content-Type: text/plain; charset=UTF-8
|
|
|
63354d5 |
Content-Transfer-Encoding: 8bit
|
|
|
63354d5 |
|
|
|
63354d5 |
This partially reverts 7aba6e53bbfeedaacd95bbaa5e0c5e325a3e6a8d, which
|
|
|
63354d5 |
results in “event” being inappropriately freed before a “goto” statement
|
|
|
63354d5 |
is executed and the value stored in “g_event_selected” is read.
|
|
|
63354d5 |
---
|
|
|
63354d5 |
src/gui-wizard-gtk/wizard.c | 6 +++++-
|
|
|
63354d5 |
1 file changed, 5 insertions(+), 1 deletion(-)
|
|
|
63354d5 |
|
|
|
63354d5 |
diff --git a/src/gui-wizard-gtk/wizard.c b/src/gui-wizard-gtk/wizard.c
|
|
|
63354d5 |
index a4d7caa0..3e69a513 100644
|
|
|
63354d5 |
--- a/src/gui-wizard-gtk/wizard.c
|
|
|
63354d5 |
+++ b/src/gui-wizard-gtk/wizard.c
|
|
|
63354d5 |
@@ -2635,7 +2635,7 @@ static gint select_next_page_no(gint current_page_no)
|
|
|
63354d5 |
|
|
|
63354d5 |
log_info("%s: Looking for next event to process", __func__);
|
|
|
63354d5 |
/* (note: this frees and sets to NULL g_event_selected) */
|
|
|
63354d5 |
- g_autofree char *event = setup_next_processed_event(&g_auto_event_list);
|
|
|
63354d5 |
+ char *event = setup_next_processed_event(&g_auto_event_list);
|
|
|
63354d5 |
if (!event)
|
|
|
63354d5 |
{
|
|
|
63354d5 |
current_page_no = PAGENO_EVENT_PROGRESS - 1;
|
|
|
63354d5 |
@@ -2644,6 +2644,8 @@ static gint select_next_page_no(gint current_page_no)
|
|
|
63354d5 |
|
|
|
63354d5 |
if (!get_sensitive_data_permission(event))
|
|
|
63354d5 |
{
|
|
|
63354d5 |
+ free(event);
|
|
|
63354d5 |
+
|
|
|
63354d5 |
cancel_processing(g_lbl_event_log, /* default message */ NULL, TERMINATE_NOFLAGS);
|
|
|
63354d5 |
current_page_no = PAGENO_EVENT_PROGRESS - 1;
|
|
|
63354d5 |
goto again;
|
|
|
63354d5 |
@@ -2659,6 +2661,8 @@ static gint select_next_page_no(gint current_page_no)
|
|
|
63354d5 |
|
|
|
63354d5 |
if (libreport_get_global_stop_on_not_reportable())
|
|
|
63354d5 |
{
|
|
|
63354d5 |
+ free(event);
|
|
|
63354d5 |
+
|
|
|
63354d5 |
cancel_processing(g_lbl_event_log, msg, TERMINATE_NOFLAGS);
|
|
|
63354d5 |
current_page_no = PAGENO_EVENT_PROGRESS - 1;
|
|
|
63354d5 |
goto again;
|
|
|
63354d5 |
--
|
|
|
63354d5 |
2.28.0
|
|
|
63354d5 |
|