From 567cae2630a51efddc07eacff3b38a295e1f5671 Mon Sep 17 00:00:00 2001 From: Christian Brabandt Date: Sun, 19 Nov 2023 16:19:27 +0100 Subject: [PATCH] patch 9.0.2117: [security] use-after-free in qf_free_items Problem: [security] use-after-free in qf_free_items Solution: only access qfpnext, if it hasn't been freed Coverity discovered a possible use-after-free in qf_free_items. When freeing the qfline items, we may access freed memory, when qfp == qfpnext. So only access qfpnext, when it hasn't been freed. Signed-off-by: Christian Brabandt --- src/quickfix.c | 3 ++- src/version.c | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/src/quickfix.c b/src/quickfix.c index 207331f9b5..dd681ca239 100644 --- a/src/quickfix.c +++ b/src/quickfix.c @@ -4000,8 +4000,9 @@ qf_free_items(qf_list_T *qfl) // to avoid crashing when it's wrong. // TODO: Avoid qf_count being incorrect. qfl->qf_count = 1; + else + qfl->qf_start = qfpnext; } - qfl->qf_start = qfpnext; --qfl->qf_count; } diff --git a/src/version.c b/src/version.c index ed11338127..6994b3402c 100644 --- a/src/version.c +++ b/src/version.c @@ -704,6 +704,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 2117, /**/ 2116, /**/