Re: [gmime-devel] Double free crash in g_mime_header_list_register_writer()



Hi Johan,

Looks like there is indeed a double-free. I just read over the documentation and g_hash_table_remove() free's the key for us, so there's no need to free it (again).

The fix is to replace the whole g_hash_table_lookup if-block with:

g_hash_table_remove (headers->writers, name);

I've committed a fix to git master, but git master is 2.6.21, not 2.4.21

Hope that helps,

Jeff

On 7/18/2014 7:09 AM, Johan van den Berg wrote:
Hi

I am using gmime 2.4.21 (installed with yum on RHEL6) and glib2
2.26.1, and I am trying to disable header folding.

The crash occurs when calling g_mime_header_list_register_writer().

Is there something I am missing?


Regards
Johan



*** glibc detected *** ./gmimetest: double free or corruption
(fasttop): 0x0000000002552910 ***
======= Backtrace: =========
/lib64/libc.so.6[0x3209475916]
/usr/lib64/libgmime-2.4.so.2(g_mime_header_list_register_writer+0x62)[0x32fee1c642]
./gmimetest[0x401c13]
./gmimetest[0x4021c7]
/lib64/libc.so.6(__libc_start_main+0xfd)[0x320941ecdd]
./gmimetest[0x401619]

This happens when g_free(okey) is called after
g_hash_lookup_extended() is called. As far as I can tell from my
debugger, okey points to an empty string, however I don't know glib
hash tables very well so this might not be relevant.

Snippet from cgdb in /usr/src/debug/gmime-2.4.21/gmime/gmime-header.c:

  924| void
  925| g_mime_header_list_register_writer (GMimeHeaderList *headers,
const char *name, GMimeHeaderWriter writer)
  926| {
  927|         gpointer okey, oval;
  928|
  929|         g_return_if_fail (headers != NULL);
  930|         g_return_if_fail (name != NULL);
  931|
  932|         if (g_hash_table_lookup (headers->writers, name)) {
  933|                 g_hash_table_lookup_extended (headers->writers,
name, &okey, &oval);
  934|                 g_hash_table_remove (headers->writers, name);
  935+>                g_free (okey);
  936|         }
  937|
  938|         if (writer)
  939|                 g_hash_table_insert (headers->writers, g_strdup
(name), writer);
  940| }


My offending code snippet:

--------------------------

#include <glib.h>
#include <gmime/gmime.h>

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>

void build_multipart(void);
ssize_t nonfolding_mime_header_writer (GMimeStream *stream, const char
* name, const char * value);
char * nonfolding_mime_header_printf(const char * format, ...);

int main (int argc, char **argv)
{
     g_mime_init (0);

     build_multipart();

     return 0;
}

void build_multipart(void)
{
     GMimeMultipart * multipart;
     GMimeHeaderList * headers;

     multipart = g_mime_multipart_new_with_subtype("related");
     headers = g_mime_object_get_header_list((GMimeObject *) multipart);
     g_mime_object_set_content_type_parameter((GMimeObject *)
multipart, "type", "text/xml");
     g_mime_object_set_content_type_parameter((GMimeObject *)
multipart, "start", "<xyz>");
     g_mime_header_list_register_writer(headers, "Content-Type",
nonfolding_mime_header_writer);
}

ssize_t nonfolding_mime_header_writer (GMimeStream *stream, const char
* name, const char * value)
{
ssize_t     nwritten;
char *      val;
val = nonfolding_mime_header_printf ("%s: %s\n", name, value);
nwritten = g_mime_stream_write_string (stream, val);
g_free (val);
return nwritten;
}

char * nonfolding_mime_header_printf(const char * format, ...)
{
char *  buf;
va_list ap;
va_start (ap, format);
buf = g_strdup_vprintf (format, ap);
va_end (ap);
return buf;
}

--------------------------
_______________________________________________
gmime-devel-list mailing list
gmime-devel-list gnome org
https://mail.gnome.org/mailman/listinfo/gmime-devel-list



Attachment: smime.p7s
Description: S/MIME Cryptographic Signature



[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]