Date: Wed, 3 Sep 2008 21:01:51 GMT From: Jeff Blank <jfb@mr-happy.com> To: freebsd-gnats-submit@FreeBSD.org Subject: ports/127075: comms/qpage segmentation fault due to freeing already-freed memory Message-ID: <200809032101.m83L1piE011666@www.freebsd.org> Resent-Message-ID: <200809032110.m83LA18t052328@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 127075
>Category: ports
>Synopsis: comms/qpage segmentation fault due to freeing already-freed memory
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-ports-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Sep 03 21:10:01 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator: Jeff Blank
>Release: FreeBSD 7.0-RELEASE
>Organization:
>Environment:
FreeBSD zorak.tc.mtu.edu 7.0-RELEASE-p3 FreeBSD 7.0-RELEASE-p3 #0: Mon Jul 14 17:18:38 EDT 2008 root@zorak.tc.mtu.edu:/usr/obj/usr/src/sys/ULE_POLLING i386
>Description:
When qpage in daemon mode receives a SIGHUP, it frees malloc-ed memory before rereading its configuration file. The problem occurs on line 1410 of config.c, where a pointer to a service declaration is freed. The memory at that address is not a separate allocation for each PAGER struct, and furthermore, the entire service list has been freed by the time free_pagers() is called. Calling free() on a pointer that points to unallocated memory appears to cause a segmentation fault.
>How-To-Repeat:
Build and install ports/qpage. No tunables are present in the Makefile. Install a working qpage.cf in /usr/local/etc (perhaps just using the qpage-example.cf provided). It is not necessary to have a modem available as long as the configuration file can be edited to reference an existing /dev/cua* device that is not otherwise in use ("modem=/dev/XXX" in qpage.cf). Execute '/usr/local/etc/rc.d/qpage.sh start'. At this point, there should be one qpage process running. Send the process a SIGHUP, wait a moment, and send another SIGHUP. qpage will have exited with a segmentation fault (logged to /var/log/messages by a standard FreeBSD configuration).
>Fix:
attached patch
Patch attached with submission follows:
--- config.c.orig Fri Jan 1 22:14:50 1999
+++ config.c Wed May 4 16:28:49 2005
@@ -1407,7 +1407,6 @@
my_free(list->name);
my_free(list->text);
my_free(list->pagerid);
- my_free(list->service);
free(list);
}
}
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200809032101.m83L1piE011666>