[Bug 16105] New: Read from pointer after free at rmaliases function, ash.c file

[bugzilla at busybox.net]

https://bugs.busybox.net/show_bug.cgi?id=16105

            Bug ID: 16105
           Summary: Read from pointer after free at rmaliases function,
                    ash.c file
           Product: Busybox
           Version: 1.37.x
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: major
          Priority: P5
         Component: Other
          Assignee: unassigned at busybox.net
          Reporter: marcin.w.nowakowski at gmail.com
                CC: busybox-cvs at busybox.net
  Target Milestone: ---

Static analyses tool shows an issue in ash.c file, rmaliases function.
The issue is Read from pointer after free (USE_AFTER_FREE).
The detailed information is provided below.

3515static void
3516rmaliases(void)
3517{
3518        struct alias *ap, **app;
3519        int i;
3520
3521        INT_OFF;
1. Condition i < 39, taking true branch.
3522        for (i = 0; i < ATABSIZE; i++) {
3523                app = &atab[i];
2. Condition ap, taking true branch.
5. alias: Assigning: ap = *app. Now both point to the same storage.
6. Condition ap, taking true branch.
3524                for (ap = *app; ap; ap = *app) {
7. freed_arg: freealias frees *app.["show details"]
3525                        *app = freealias(*app);
3. Condition ap == *app, taking true branch.
8. Condition ap == *app, taking true branch.
3526                        if (ap == *app) {
CID 5896585: (#1 of 1): Read from pointer after free (USE_AFTER_FREE)
9. deref_after_free: Dereferencing freed pointer ap.
3527                                app = &ap->next;
3528                        }
4. Jumping back to the beginning of the loop.
3529                }
3530        }
3531        INT_ON;
3532}

-- 
You are receiving this mail because:
You are on the CC list for the bug.