Wireshark · Wireshark-commits: [Wireshark-commits] master b1e0cb0: coap: fix use-after-free of "coinfo->ctype_str"

[Wireshark code review <code-review-do-not-reply@xxxxxxxxxxxxx>]

URL: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=b1e0cb01b33d1e6798e5f3b2f649b2359874c622
Submitter: Anders Broman (a.broman58@xxxxxxxxx)
Changed: branch: master
Repository: wireshark

Commits:

b1e0cb0 by Peter Wu (peter@xxxxxxxxxxxxx):

    coap: fix use-after-free of "coinfo->ctype_str"
    
    A use-after-free is possible through the following path:
    
        // returns wmem_packet_scope() memory
        coinfo->ctype_str = val_to_str(coinfo->ctype_value, vals_ctype, "Unknown Type %u");
        // leaks packet scoped memory into conversation
        coap_trans = wmem_new0(wmem_file_scope(), coap_transaction);
        coap_trans->req_ctype_str = coinfo->ctype_str;  // <-- oops
        // next packet: use-after-free of packet scoped memory
        coinfo->ctype_str = coap_trans->req_ctype_str;
    
    This could be fixed by duplicating "ctype_str" with wmem_file_scope, but
    since all "ctype_str" strings are constant, make the problematic
    "ctype_str" assignment also constant for unknown types (the numeric type
    is also stored in "ctype_value" if necessary).
    
    Change-Id: I6249e076fa282bbe0982b8c709788e27f6fdf86e
    Fixes: v2.9.0rc0-317-g46fcf452ac ("coap: Store ctype values in transaction tracking")
    Link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8196
    Reviewed-on: https://code.wireshark.org/review/27477
    Petri-Dish: Peter Wu <peter@xxxxxxxxxxxxx>
    Tested-by: Petri Dish Buildbot
    Reviewed-by: Anders Broman <a.broman58@xxxxxxxxx>
    

Actions performed:

    from  5b385f3   [Automatic update for 2018-05-13]
    adds  b1e0cb0   coap: fix use-after-free of "coinfo->ctype_str"


Summary of changes:
 epan/dissectors/packet-coap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)