diff options
| author | Jo-Philipp Wich | 2025-09-16 15:12:14 +0000 |
|---|---|---|
| committer | Daniel Golle | 2026-03-14 00:29:08 +0000 |
| commit | 7e5e0491d6366445accb542cf35d15999fdae35e (patch) | |
| tree | c2a756859bb2d6739ac2b71ee18f92a29a6b8d0e | |
| parent | 3f48d7600fc72c88bf8234e236b7c96884675a40 (diff) | |
service: fix use-after-free on service data update
When updating runtime data for service already having previous data, the
call to service_data_trigger() will indirectly access the just freed
`s->data` memory through the `s->data_blob` AVL structure.
Fix this issue by moving the call to `service_data_trigger()` before the
freeing of `s->data`.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit ace5f272e139b5b1f98e992b2590ed1384e2774e)
| -rw-r--r-- | service/service.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/service/service.c b/service/service.c index 515c992..cf8192c 100644 --- a/service/service.c +++ b/service/service.c @@ -137,13 +137,14 @@ service_update_data(struct service *s, struct blob_attr *data) if (blob_attr_equal(s->data, data)) return 0; + service_data_trigger(&s->data_blob); + blobmsg_list_free(&s->data_blob); + free(s->data); s->data = blob_memdup(data); if (!s->data) return -1; - service_data_trigger(&s->data_blob); - blobmsg_list_free(&s->data_blob); blobmsg_list_fill(&s->data_blob, blobmsg_data(s->data), blobmsg_data_len(s->data), false); service_data_trigger(&s->data_blob); |