diff options
| author | Shell <[email protected]> | 2024-10-11 14:45:39 +0800 |
|---|---|---|
| committer | Rbb666 <[email protected]> | 2024-10-21 17:15:52 +0800 |
| commit | cfe1768815df56ed2b8f4c2909cb7c5684fad752 (patch) | |
| tree | 34c1172d849b889fdec609523ed0b7f95a19c0c4 /components | |
| parent | fabee02c38f3c9f6bfee86436d5c2f0e8757268b (diff) | |
fixup: smart: sys_mount: UAF vulnerability
This patch addresses a use-after-free (UAF) vulnerability in the
sys_mount. The issue occurred due to improper handling of memory
deallocation, which could lead to crashes or undefined behavior on user
request of mounting.
Changes made:
- Moved the `rt_free(copy_source)` function call to occur after the necessary
operations are completed, preventing premature deallocation of memory.
Signed-off-by: Shell <[email protected]>
Diffstat (limited to 'components')
| -rw-r--r-- | components/lwp/lwp_syscall.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/components/lwp/lwp_syscall.c b/components/lwp/lwp_syscall.c index d64af4455a..6e99abe8a7 100644 --- a/components/lwp/lwp_syscall.c +++ b/components/lwp/lwp_syscall.c @@ -5810,13 +5810,13 @@ sysret_t sys_mount(char *source, char *target, if (copy_source && stat(copy_source, &buf) && S_ISBLK(buf.st_mode)) { char *dev_fullpath = dfs_normalize_path(RT_NULL, copy_source); - rt_free(copy_source); RT_ASSERT(rt_strncmp(dev_fullpath, "/dev/", sizeof("/dev/") - 1) == 0); ret = dfs_mount(dev_fullpath + sizeof("/dev/") - 1, copy_target, copy_filesystemtype, 0, tmp); if (ret < 0) { ret = -rt_get_errno(); } + rt_free(copy_source); rt_free(dev_fullpath); } else |