Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix code scanning alert no. 1: Potential use after free #9

Merged
merged 1 commit into from
Oct 17, 2024

Conversation

cooljeanius
Copy link
Owner

Fixes https://github.com/cooljeanius/mdnsd/security/code-scanning/1

To fix the use-after-free issue, we need to ensure that the pointer r->rr.rdata is not accessed after it has been freed unless it is reassigned a valid memory block. Additionally, we should add error handling to check if malloc fails and handle that scenario appropriately.

  • First, free the existing memory block pointed to by r->rr.rdata.
  • Set the pointer to NULL immediately after freeing it to avoid accidental use.
  • Allocate a new memory block and check if the allocation was successful.
  • If the allocation fails, handle the error appropriately (e.g., by logging an error message and returning from the function).
  • If the allocation succeeds, proceed with copying the data.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

since there's no xmalloc() here, looks like we have to open-code it manually...

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
mdnsd.c Dismissed Show dismissed Hide dismissed
@cooljeanius cooljeanius marked this pull request as ready for review October 17, 2024 04:49
Copy link
Owner Author

@cooljeanius cooljeanius left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

may not fix it, but worth doing anyways

@cooljeanius cooljeanius merged commit 2aba821 into master Oct 17, 2024
13 checks passed
@cooljeanius cooljeanius deleted the alert-autofix-1 branch October 17, 2024 04:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant