Sec Bug->Bug #68720 [Opn->Nab]: use-after-free
| From: | stas@php.net | Date: | Sat, 03 Jan 2015 05:34:04 +0000 |
| Subject: | Sec Bug->Bug #68720 [Opn->Nab]: use-after-free | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-189618@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=68720&edit=1
ID: 68720
Updated by: stas@php.net
Reported by: bugreports at internot dot info
Summary: use-after-free
-Status: Open
+Status: Not a bug
-Type: Security
+Type: Bug
Package: XMLRPC-EPI related
Operating System: Linux Ubuntu 14.04
PHP Version: 5.4Git-2015-01-02 (Git)
Block user comment: N
Private report: Y
New Comment:
It's not really use after free, since iter is never dereferenced, it is just compared to
another pointer. As far as I can see, there's nothing dangerous in comparing pointer to
pointer, even if the memory under that pointer was deallocated.
Previous Comments:
------------------------------------------------------------------------
[2015-01-02 08:57:24] bugreports at internot dot info
Description:
------------
Hi,
In /ext/xmlrpc/libxmlrpc/queue.c a use-after-free occurs:
542 free(iter);
[..]
547 if (q->cursor == (node*)iter) {
Thanks,
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=68720&edit=1