osmocom
/
wireshark
11
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

Wiretap: Fix temporary filename memory corruption 

The pointer returned by create_tempfile() must not be freed. As the
wtap_dump_open_tempfile() callers are freeing the returned filename,
duplicate the string so it can be freed.

Bug: 15377
Change-Id: Ib0b23aaee748ef67600ef3f7d40610ebbbec721c
Reviewed-on: https://code.wireshark.org/review/34272
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
This commit is contained in:
Tomasz Moń 2019-08-13 18:41:23 +02:00 committed by Peter Wu
parent 81d2de9252
commit c4b68b4935
5 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
file.c
View File

@ -1373,7 +1373,7 @@ merge_callback(merge_event event, int num _U_,
cf_status_t
cf_merge_files_to_tempfile(gpointer pd_window, char **out_filenamep,
int in_file_count, char *const *in_filenames,
int in_file_count, const char *const *in_filenames,
int file_type, gboolean do_append)
{
int err = 0;
@ -1393,7 +1393,7 @@ cf_merge_files_to_tempfile(gpointer pd_window, char **out_filenamep,
/* merge the files */
status = merge_files_to_tempfile(out_filenamep, "wireshark", file_type,
(const char *const *) in_filenames,
in_filenames,
in_file_count, do_append,
IDB_MERGE_MODE_ALL_SAME, 0 /* snaplen */,
"Wireshark", &cb, &err, &err_info,

2
file.h
View File

@ -663,7 +663,7 @@ void cf_unignore_frame(capture_file *cf, frame_data *frame);
*/
cf_status_t
cf_merge_files_to_tempfile(gpointer pd_window, char **out_filenamep,
int in_file_count, char *const *in_filenames,
int in_file_count, const char *const *in_filenames,
int file_type, gboolean do_append);

1
ui/qt/import_text_dialog.cpp
View File

@ -127,6 +127,7 @@ void ImportTextDialog::convertTextFile() {
/* Use a random name for the temporary import buffer */
import_info_.wdh = wtap_dump_open_tempfile(&tmpname, "import", WTAP_FILE_TYPE_SUBTYPE_PCAPNG, WTAP_UNCOMPRESSED, &params, &err);
capfile_name_.append(tmpname ? tmpname : "temporary file");
g_free(tmpname);
qDebug() << capfile_name_ << ":" << import_info_.wdh << import_info_.encapsulation << import_info_.max_frame_length;
if (import_info_.wdh == NULL) {
cfile_dump_open_failure_alert_box(capfile_name_.toUtf8().constData(), err, WTAP_FILE_TYPE_SUBTYPE_PCAP);

5
ui/qt/main_window.cpp
View File

@ -1017,11 +1017,11 @@ void MainWindow::dropEvent(QDropEvent *event)
return;
}
char **in_filenames = (char **)g_malloc(sizeof(char*) * local_files.size());
const char **in_filenames = g_new(const char *, local_files.size());
char *tmpname = NULL;
for (int i = 0; i < local_files.size(); i++) {
in_filenames[i] = const_cast<char *>(local_files.at(i).constData());
in_filenames[i] = local_files.at(i).constData();
}
/* merge the files in chronological order */
@ -1035,7 +1035,6 @@ void MainWindow::dropEvent(QDropEvent *event)
g_free(tmpname);
g_free(in_filenames);
}
// Apply recent settings to the main window geometry.

2
wiretap/file_access.c
View File

@ -2450,7 +2450,7 @@ wtap_dump_open_tempfile(char **filenamep, const char *pfx,
g_free(wdh);
return NULL; /* can't create file */
}
*filenamep = tmpname;
*filenamep = g_strdup(tmpname);
/* In case "fopen()" fails but doesn't set "errno", set "errno"
to a generic "the open failed" error. */