autofs-5.1.9 - initialise fields after free in clear_amd_entry() From: Ian Kent Avoid potential use after free bugs by reinitialising fields that are freed in clear_amd_entry(). Signed-off-by: Ian Kent --- CHANGELOG | 1 + lib/mounts.c | 60 ++++++++++++++++++++++++++++++++++++++++++++-------------- 2 files changed, 46 insertions(+), 15 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 65090c0f5..a23645139 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -84,6 +84,7 @@ - skip expire check for amd nounmount mounts. - Fix masks in parse_sub.c, so that hosts are correctly matched. - fix fields not freed in clear_amd_entry(). +- initialise fields after free in clear_amd_entry(). 02/11/2023 autofs-5.1.9 - fix kernel mount status notification. diff --git a/lib/mounts.c b/lib/mounts.c index effedc631..8905cedb8 100644 --- a/lib/mounts.c +++ b/lib/mounts.c @@ -643,36 +643,66 @@ void clear_amd_entry(struct amd_entry *entry) { if (!entry) return; - if (entry->path) + if (entry->path) { free(entry->path); - if (entry->type) + entry->path = NULL; + } + if (entry->type) { free(entry->type); - if (entry->map_type) + entry->type = NULL; + } + if (entry->map_type) { free(entry->map_type); - if (entry->pref) + entry->map_type = NULL; + } + if (entry->pref) { free(entry->pref); - if (entry->fs) + entry->pref = NULL; + } + if (entry->fs) { free(entry->fs); - if (entry->rhost) + entry->fs = NULL; + } + if (entry->rhost) { free(entry->rhost); - if (entry->rfs) + entry->rhost = NULL; + } + if (entry->rfs) { free(entry->rfs); - if (entry->dev) + entry->rfs = NULL; + } + if (entry->dev) { free(entry->dev); - if (entry->opts) + entry->dev = NULL; + } + if (entry->opts) { free(entry->opts); - if (entry->addopts) + entry->opts = NULL; + } + if (entry->addopts) { free(entry->addopts); - if (entry->remopts) + entry->addopts = NULL; + } + if (entry->remopts) { free(entry->remopts); - if (entry->sublink) + entry->remopts = NULL; + } + if (entry->sublink) { free(entry->sublink); - if (entry->mount) + entry->sublink = NULL; + } + if (entry->mount) { free(entry->mount); - if (entry->umount) + entry->mount = NULL; + } + if (entry->umount) { free(entry->umount); - if (entry->selector) + entry->umount = NULL; + } + if (entry->selector) { free_selector(entry->selector); + entry->selector = NULL; + } return; }