[PW_SID:1144590] Fix two crashes in the agent request path - #512
[PW_SID:1144590] Fix two crashes in the agent request path#512IWDTestBot wants to merge 2 commits into
Conversation
display_agent_prompt_release() destroys the stdin l_io but leaves the file-static pointer set. Both creation sites are guarded by "if (!io)", so it is never recreated and any later use touches freed memory. RequestUserNameAndPassword is the only request that prompts twice, so the password prompt installs a read handler on the destroyed io. The input is never read and no reply is sent, and the Cancel handler or the exit path then destroys the same io again: free(): double free detected in tcache 2 Clear the pointer at both destroy sites. l_io_destroy(NULL) is a no-op. Fixes: df32279 ("client: Enable non-interactive mode support for agent prompts")
request_timeout() cancels the outstanding call but leaves agent->pending_id set. agent_finalize_pending() pops the last request and agent_send_next_request() returns early on the empty queue, so the stale id survives with nothing queued. When the agent later drops off the bus, agent_disconnect() tests that id and calls agent_finalize_pending() again, which pops NULL off the empty queue and dereferences it: #0 agent_finalize_pending (agent=0x..., reply=0x0) at src/agent.c:187 #1 agent_disconnect (...) at src/agent.c:511 #2 _dbus_name_cache_notify (...) at ell/dbus-name-cache.c:188 #4 name_owner_changed_cb (...) at ell/dbus.c:861 agent_receive_reply() and agent_request_cancel() already clear pending_id in this situation. Do the same on timeout, and guard agent_finalize_pending() against an empty queue. Fixes: d04ab5a ("agent: call back even if agent disconnects")
|
Fetch PR Prep - Setup ELL Make Distcheck Build - Configure Make Check Make Check w/Valgrind Incremental Build with patches |
|
Fetch PR GitLint Output: Prep - Setup ELL Make Distcheck Build - Configure Make Check Make Check w/Valgrind Incremental Build with patches Autotest Runner Clang Build |
2 participants
display_agent_prompt_release() destroys the stdin l_io but leaves the
file-static pointer set. Both creation sites are guarded by "if (!io)",
so it is never recreated and any later use touches freed memory.
RequestUserNameAndPassword is the only request that prompts twice, so
the password prompt installs a read handler on the destroyed io. The
input is never read and no reply is sent, and the Cancel handler or the
exit path then destroys the same io again:
free(): double free detected in tcache 2
Clear the pointer at both destroy sites. l_io_destroy(NULL) is a no-op.
Fixes: df32279 ("client: Enable non-interactive mode support for agent prompts")
client/display.c | 2 ++
1 file changed, 2 insertions(+)