An ubus RPC daemon for Liminix
bd0ed25214
In some cases, e.g. when subsequently setting multiple empty option values, uci_set() might free the section pointer of the given reused uci_ptr structure without zeroing it, leading to a use-after-free on processing subsequent options. Avoid this issue by clearing the lookup pointer flags in order to prevent uci_set() from incorrectly branching into a uci_delete() operation leading to the freeing of the section member. Ref: http://lists.infradead.org/pipermail/openwrt-devel/2019-October/019592.html Reported-by: Daniel Danzberger <daniel@dd-wrt.com> Suggested-by: Yousong Zhou <yszhou4tech@gmail.com> Signed-off-by: Jo-Philipp Wich <jo@mein.io> |
||
|---|---|---|
| include/rpcd | ||
| CMakeLists.txt | ||
| exec.c | ||
| file.c | ||
| iwinfo.c | ||
| main.c | ||
| plugin.c | ||
| session.c | ||
| sys.c | ||
| uci.c | ||
| unauthenticated.json | ||