Skip to content

Commit caaf50b

Browse files
ssrish17Daniel Kiper
authored andcommitted
osdep/aros/hostdisk: Fix use-after-free bug during MsgPort deletion
... in function grub_util_fd_open() when creation of an I/O request or opening a device fails. The "ret", the file descriptor, will be freed before its associated MsgPort is deleted resulting in a use-after-free condition. Fix this issue by freeing "ret" after its associated MsgPort has been deleted. Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com> Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com> Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
1 parent 18f0882 commit caaf50b

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

grub-core/osdep/aros/hostdisk.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -207,8 +207,8 @@ grub_util_fd_open (const char *dev, int flg)
207207
sizeof(struct IOExtTD));
208208
if (!ret->ioreq)
209209
{
210-
free (ret);
211210
DeleteMsgPort (ret->mp);
211+
free (ret);
212212
return NULL;
213213
}
214214

@@ -225,9 +225,9 @@ grub_util_fd_open (const char *dev, int flg)
225225
if (OpenDevice ((unsigned char *) tmp, unit,
226226
(struct IORequest *) ret->ioreq, flags))
227227
{
228-
free (tmp);
229-
free (ret);
230228
DeleteMsgPort (ret->mp);
229+
free (ret);
230+
free (tmp);
231231
return NULL;
232232
}
233233
free (tmp);

0 commit comments

Comments
 (0)