Re: [nfs-utils PATCH 2/2] junction: fix use-after-free in locations_to_fslocdata()

[Steve Dickson <steved@redhat.com>]

On 9/3/26 1:53 PM, Scott Mayhew wrote:
> While parsing a multi-location junction, locations_to_fslocdata() sets
> last_path = root_path and then frees root_path, leaving last_path
> dangling.  On the next iteration, strcmp(rootpath, last_path)
> dereferences freed memory.
> 
> Fix it by transferring ownership of root_path to last_path when they
> should be aliased.
> 
> Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Committed... (tag: nfs-utils-2-9-3-rc4)

steved.
> ---
>   support/export/cache.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/support/export/cache.c b/support/export/cache.c
> index 059f48a7..9f71c1dd 100644
> --- a/support/export/cache.c
> +++ b/support/export/cache.c
> @@ -2806,19 +2806,25 @@ static bool locations_to_fslocdata(struct nfs_fsloc_set *locations,
>   			}
>   			remaining -= (size_t)len;
>   			ptr += len;
> +			free(last_path);
>   			last_path = rootpath;
> +			rootpath = NULL;
>   		}
>   
>   		seen = true;
>   		free(rootpath);
> +		rootpath = NULL;
>   		free(server);
> +		server = NULL;
>   	}
>   
> +	free(last_path);
>   	xlog(D_CALL, "%s: fslocdata='%s', ttl=%d",
>   		__func__, fslocdata, *ttl);
>   	return seen;
>   
>   out_false:
> +	free(last_path);
>   	free(rootpath);
>   	free(server);
>   	return false;