[PATCH] lib/message.cc: fix Coverity finding (use after free)

classic Classic list List threaded Threaded
2 messages Options
Tomi Ollila-2 Tomi Ollila-2
Reply | Threaded
Open this post in threaded view
|

[PATCH] lib/message.cc: fix Coverity finding (use after free)

The object where pointer to `data` was received was deleted before
it was used in _notmuch_string_list_append().

Relevant Coverity messages follow:

3: extract
Assigning: data = std::__cxx11::string(message->doc.()).c_str(),
which extracts wrapped state from temporary of type std::__cxx11::string.

4: dtor_free
The internal representation of temporary of type std::__cxx11::string
is freed by its destructor.

5: use after free:
Wrapper object use after free (WRAPPER_ESCAPE)
Using internal representation of destroyed object local data.
---

There were 30+ other 'defects' found, but none of the other seems
dangerous (and very few are kinda false). I forked github repo
of notmuch and tried this free oss coverity service -- they were
surprisingly quick to grant me access to the defects...

 lib/message.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/message.cc b/lib/message.cc
index e08659e5d96a..cb313326270e 100644
--- a/lib/message.cc
+++ b/lib/message.cc
@@ -870,9 +870,9 @@ _notmuch_message_ensure_filename_list (notmuch_message_t *message)
  *
  * It would be nice to do the upgrade of the document directly
  * here, but the database is likely open in read-only mode. */
- const char *data;
 
- data = message->doc.get_data ().c_str ();
+ std::string datastr = message->doc.get_data ();
+ const char *data = datastr.c_str ();
 
  if (data == NULL)
     INTERNAL_ERROR ("message with no filename");
--
2.11.0

_______________________________________________
notmuch mailing list
[hidden email]
https://notmuchmail.org/mailman/listinfo/notmuch
David Bremner-2 David Bremner-2
Reply | Threaded
Open this post in threaded view
|

Re: [PATCH] lib/message.cc: fix Coverity finding (use after free)

Tomi Ollila <[hidden email]> writes:

> - const char *data;
>  
> - data = message->doc.get_data ().c_str ();
> + std::string datastr = message->doc.get_data ();
> + const char *data = datastr.c_str ();
>  

Pushed,

d
_______________________________________________
notmuch mailing list
[hidden email]
https://notmuchmail.org/mailman/listinfo/notmuch