opkg: fix use-after-free with duplicate packages on the command line
authorJo-Philipp Wich <jo@mein.io>
Sat, 23 Apr 2016 12:03:50 +0000 (14:03 +0200)
committerJo-Philipp Wich <jo@mein.io>
Sat, 23 Apr 2016 12:03:50 +0000 (14:03 +0200)
When the same package file is specified multiple times on the opkg install
command line, the name pointer on the argv array becomes stale after the
package structures have been merged, leading to invalid memory accesses
upon install.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
package/system/opkg/Makefile
package/system/opkg/patches/270-fix-use-after-free.patch [new file with mode: 0644]

index 01a7d79..af44742 100644 (file)
@@ -1,5 +1,6 @@
 #
 # Copyright (C) 2006-2015 OpenWrt.org
+# Copyright (C) 2016 LEDE Project
 #
 # This is free software, licensed under the GNU General Public License v2.
 # See /LICENSE for more information.
@@ -12,7 +13,7 @@ include $(INCLUDE_DIR)/feeds.mk
 PKG_NAME:=opkg
 PKG_REV:=9c97d5ecd795709c8584e972bfdf3aee3a5b846d
 PKG_VERSION:=$(PKG_REV)
-PKG_RELEASE:=12
+PKG_RELEASE:=13
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_VERSION:=$(PKG_REV)
diff --git a/package/system/opkg/patches/270-fix-use-after-free.patch b/package/system/opkg/patches/270-fix-use-after-free.patch
new file mode 100644 (file)
index 0000000..96e24b9
--- /dev/null
@@ -0,0 +1,11 @@
+--- a/libopkg/opkg_download.c
++++ b/libopkg/opkg_download.c
+@@ -335,7 +335,7 @@ opkg_prepare_url_for_install(const char
+      hash_insert_pkg(pkg, 1);
+      if (namep) {
+-        *namep = pkg->name;
++        *namep = xstrdup(pkg->name);
+      }
+      return 0;
+ }