From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtpng1.m.smailru.net (smtpng1.m.smailru.net [94.100.181.251]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 2097E46970F for ; Sat, 30 Nov 2019 00:39:05 +0300 (MSK) From: Maria Date: Sat, 30 Nov 2019 00:39:05 +0300 Message-Id: <20191129213905.36097-1-maria.khaydich@tarantool.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: [Tarantool-patches] [PATCH] Memtx_tuple_delete used heap after free List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: tarantool-patches@dev.tarantool.org, georgy@tarantool.org Struct of type tuple_format is being passed as an argument to tuple_format_unref where it might be freed. On such occasion any further references to format fields should not take place. Closes #4658 --- Issue: https://github.com/tarantool/tarantool/issues/4658 Branch: https://github.com/tarantool/tarantool/compare/eljashm/gh-4658-heap-use-after-free src/box/memtx_engine.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/box/memtx_engine.c b/src/box/memtx_engine.c index 23ccc4703..bdce4ac32 100644 --- a/src/box/memtx_engine.c +++ b/src/box/memtx_engine.c @@ -1177,13 +1177,13 @@ memtx_tuple_delete(struct tuple_format *format, struct tuple *tuple) struct memtx_engine *memtx = (struct memtx_engine *)format->engine; say_debug("%s(%p)", __func__, tuple); assert(tuple->refs == 0); + bool is_temp = format->is_temporary; tuple_format_unref(format); struct memtx_tuple *memtx_tuple = container_of(tuple, struct memtx_tuple, base); size_t total = tuple_size(tuple) + offsetof(struct memtx_tuple, base); if (memtx->alloc.free_mode != SMALL_DELAYED_FREE || - memtx_tuple->version == memtx->snapshot_version || - format->is_temporary) + memtx_tuple->version == memtx->snapshot_version || is_temp) smfree(&memtx->alloc, memtx_tuple, total); else smfree_delayed(&memtx->alloc, memtx_tuple, total); -- 2.20.1 (Apple Git-117)