32 lines
1.0 KiB
Diff
32 lines
1.0 KiB
Diff
|
From f923b19fd85039a2b0e908391074872334646d51 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Natanael Copa <ncopa@alpinelinux.org>
|
||
|
|
Date: Wed, 15 Jan 2025 15:48:04 +0100
|
||
|
|
Subject: [PATCH] Fix use-after-free in generator
|
||
|
|
|
||
|
|
full_fname() will free the return value in the next call so we need to
|
||
|
|
duplicate it before passing it to rsyserr.
|
||
|
|
|
||
|
|
Fixes: https://github.com/RsyncProject/rsync/issues/704
|
||
|
|
---
|
||
|
|
generator.c | 6 +++++-
|
||
|
|
1 file changed, 5 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/generator.c b/generator.c
|
||
|
|
index 3f13bb95..b56fa569 100644
|
||
|
|
--- a/generator.c
|
||
|
|
+++ b/generator.c
|
||
|
|
@@ -2041,8 +2041,12 @@ int atomic_create(struct file_struct *file, char *fname, const char *slnk, const
|
||
|
|
|
||
|
|
if (!skip_atomic) {
|
||
|
|
if (do_rename(tmpname, fname) < 0) {
|
||
|
|
+ char *full_tmpname = strdup(full_fname(tmpname));
|
||
|
|
+ if (full_tmpname == NULL)
|
||
|
|
+ out_of_memory("atomic_create");
|
||
|
|
rsyserr(FERROR_XFER, errno, "rename %s -> \"%s\" failed",
|
||
|
|
- full_fname(tmpname), full_fname(fname));
|
||
|
|
+ full_tmpname, full_fname(fname));
|
||
|
|
+ free(full_tmpname);
|
||
|
|
do_unlink(tmpname);
|
||
|
|
return 0;
|
||
|
|
}
|