* [PATCH] lib/message.cc: fix Coverity finding (use after free)
@ 2017-03-17 22:28 Tomi Ollila
2017-03-19 0:14 ` David Bremner
0 siblings, 1 reply; 2+ messages in thread
From: Tomi Ollila @ 2017-03-17 22:28 UTC (permalink / raw)
To: notmuch; +Cc: tomi.ollila
The object where pointer to `data` was received was deleted before
it was used in _notmuch_string_list_append().
Relevant Coverity messages follow:
3: extract
Assigning: data = std::__cxx11::string(message->doc.()).c_str(),
which extracts wrapped state from temporary of type std::__cxx11::string.
4: dtor_free
The internal representation of temporary of type std::__cxx11::string
is freed by its destructor.
5: use after free:
Wrapper object use after free (WRAPPER_ESCAPE)
Using internal representation of destroyed object local data.
---
There were 30+ other 'defects' found, but none of the other seems
dangerous (and very few are kinda false). I forked github repo
of notmuch and tried this free oss coverity service -- they were
surprisingly quick to grant me access to the defects...
lib/message.cc | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/lib/message.cc b/lib/message.cc
index e08659e5d96a..cb313326270e 100644
--- a/lib/message.cc
+++ b/lib/message.cc
@@ -870,9 +870,9 @@ _notmuch_message_ensure_filename_list (notmuch_message_t *message)
*
* It would be nice to do the upgrade of the document directly
* here, but the database is likely open in read-only mode. */
- const char *data;
- data = message->doc.get_data ().c_str ();
+ std::string datastr = message->doc.get_data ();
+ const char *data = datastr.c_str ();
if (data == NULL)
INTERNAL_ERROR ("message with no filename");
--
2.11.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] lib/message.cc: fix Coverity finding (use after free)
2017-03-17 22:28 [PATCH] lib/message.cc: fix Coverity finding (use after free) Tomi Ollila
@ 2017-03-19 0:14 ` David Bremner
0 siblings, 0 replies; 2+ messages in thread
From: David Bremner @ 2017-03-19 0:14 UTC (permalink / raw)
To: Tomi Ollila, notmuch; +Cc: tomi.ollila
Tomi Ollila <tomi.ollila@iki.fi> writes:
> - const char *data;
>
> - data = message->doc.get_data ().c_str ();
> + std::string datastr = message->doc.get_data ();
> + const char *data = datastr.c_str ();
>
Pushed,
d
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-03-19 0:14 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-03-17 22:28 [PATCH] lib/message.cc: fix Coverity finding (use after free) Tomi Ollila
2017-03-19 0:14 ` David Bremner
Code repositories for project(s) associated with this public inbox
https://yhetil.org/notmuch.git/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).