bug#68421: Possible use after free in w32notify.c

bug#68421: Possible use after free in w32notify.c

[Stefan Kangas]

[-- Attachment #1: Type: text/plain, Size: 191 bytes --]

Could someone familiar with w32notify.c look over the attached patch?

It looks like we are trying to dereference NULL in add_watch, and
returning an already freed value from start_watching.

[-- Attachment #2: w32notify-ub.diff --]
[-- Type: text/x-diff, Size: 680 bytes --]

diff --git a/src/w32notify.c b/src/w32notify.c
index 9f8a62a1daa..c93e8796fe2 100644
--- a/src/w32notify.c
+++ b/src/w32notify.c
@@ -350,6 +350,7 @@ start_watching (const char *file, HANDLE hdir, BOOL subdirs, DWORD flags)
       xfree (dirwatch->io_info);
       xfree (dirwatch->watchee);
       xfree (dirwatch);
+      return NULL;
     }
   return dirwatch;
 }
@@ -412,10 +413,7 @@ add_watch (const char *parent_dir, const char *file, BOOL subdirs, DWORD flags)
     return NULL;
 
   if ((dirwatch = start_watching (file, hdir, subdirs, flags)) == NULL)
-    {
-      CloseHandle (hdir);
-      dirwatch->dir = NULL;
-    }
+    CloseHandle (hdir);
 
   return dirwatch;
 }

bug#68421: Possible use after free in w32notify.c

[Eli Zaretskii]

> From: Stefan Kangas <stefankangas@gmail.com>
> Date: Sat, 13 Jan 2024 01:49:36 -0600
> 
> Could someone familiar with w32notify.c look over the attached patch?
> 
> It looks like we are trying to dereference NULL in add_watch, and
> returning an already freed value from start_watching.

Feel free to install on master, and thanks.

bug#68421: Possible use after free in w32notify.c

[Stefan Kangas]

Version: 30.1

Eli Zaretskii <eliz@gnu.org> writes:

>> From: Stefan Kangas <stefankangas@gmail.com>
>> Date: Sat, 13 Jan 2024 01:49:36 -0600
>>
>> Could someone familiar with w32notify.c look over the attached patch?
>>
>> It looks like we are trying to dereference NULL in add_watch, and
>> returning an already freed value from start_watching.
>
> Feel free to install on master, and thanks.

Thanks, done in commit 893829021bd.