From 23f80af2ca2d2c5c4a6b8a45055ba9eeebd7e815 Mon Sep 17 00:00:00 2001 From: Edward Tomasz Napierala Date: Sat, 6 Sep 2008 13:17:35 +0000 Subject: [PATCH] Fix double free in setfacl(1). Description from the author: Initially, 'acl' (an 'acl_t *') is allocated, and its ACCESS_ACL and DEFAULT_ACL fields are passed to the 'libc' ACL routines for subsequent allocation. If the '-m' option (merge existing ACL with a new one) is specified, then 'set_acl_mask()' will be called and passed one of the two ACLs. This function, in turn, replaces this given ACL structure by another, freshly allocated. However, the pointer in the 'acl' variable in the caller is not updated. The caller then proceeds to free the ACL, incurring in a double free condition. Submitted by: Pedro Martelletto Approved by: rwatson (mentor) --- bin/setfacl/setfacl.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/bin/setfacl/setfacl.c b/bin/setfacl/setfacl.c index b86dbb1eac7..2286efb244a 100644 --- a/bin/setfacl/setfacl.c +++ b/bin/setfacl/setfacl.c @@ -245,10 +245,13 @@ main(int argc, char *argv[]) continue; } - if (acl_type == ACL_TYPE_ACCESS) + if (acl_type == ACL_TYPE_ACCESS) { final_acl = acl[ACCESS_ACL]; - else + acl_free(acl[DEFAULT_ACL]); + } else { final_acl = acl[DEFAULT_ACL]; + acl_free(acl[ACCESS_ACL]); + } if (need_mask && (set_acl_mask(&final_acl) == -1)) { warnx("failed to set ACL mask on %s", file->filename); @@ -269,8 +272,7 @@ main(int argc, char *argv[]) } } - acl_free(acl[ACCESS_ACL]); - acl_free(acl[DEFAULT_ACL]); + acl_free(final_acl); free(acl); }