Browse Source

sqlops: fix use-after-free by deep copying result name

When creating a new result handle, deep copy the result name.
Otherwise we might end up accessing the name after it's freed.
Timo Teräs 10 years ago
parent
commit
6e2604464e
1 changed files with 5 additions and 2 deletions
  1. 5 2
      modules/sqlops/sql_api.c

+ 5 - 2
modules/sqlops/sql_api.c

@@ -197,14 +197,16 @@ sql_result_t* sql_get_result(str *name)
 			return sr;
 		sr = sr->next;
 	}
-	sr = (sql_result_t*)pkg_malloc(sizeof(sql_result_t));
+	sr = (sql_result_t*)pkg_malloc(sizeof(sql_result_t) + name->len);
 	if(sr==NULL)
 	{
 		LM_ERR("no pkg memory\n");
 		return NULL;
 	}
 	memset(sr, 0, sizeof(sql_result_t));
-	sr->name = *name;
+	memcpy(sr+1, name->s, name->len);
+	sr->name.s = (char *)(sr + 1);
+	sr->name.len = name->len;
 	sr->resid = resid;
 	sr->next = _sql_result_root;
 	_sql_result_root = sr;
@@ -683,6 +685,7 @@ void sql_destroy(void)
 		pkg_free(r);
 		r = r0;
 	}
+	_sql_result_root = NULL;
 }
 
 /**