mirror/rsync
1
0
Fork 0
mirror of https://github.com/RsyncProject/rsync.git synced 2025-12-23 23:28:17 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix use-after-free in generator

Browse Source 
full_fname() will free the return value in the next call so we need to
duplicate it before passing it to rsyserr.

Fixes: https://github.com/RsyncProject/rsync/issues/704
This commit is contained in:
Natanael Copa
2025-01-15 15:48:04 +01:00
committed by Andrew Tridgell
parent 996af4a79f
commit 81ead9e70c
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
generator.c
View File

@@ -2041,8 +2041,12 @@ int atomic_create(struct file_struct *file, char *fname, const char *slnk, const
if (!skip_atomic) {
if (do_rename(tmpname, fname) < 0) {
char *full_tmpname = strdup(full_fname(tmpname));
if (full_tmpname == NULL)
out_of_memory("atomic_create");
rsyserr(FERROR_XFER, errno, "rename %s -> \"%s\" failed",
full_fname(tmpname), full_fname(fname));
full_tmpname, full_fname(fname));
free(full_tmpname);
do_unlink(tmpname);
return 0;
}