1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
Description: Avoid double free of connection pointers
.
libapache2-mod-auth-pgsql (2.0.3-6.1) unstable; urgency=medium
.
* Non-maintainer upload.
* Apply patch from Launchpad to set freed pointers to NULL before
subsequent checks against NULL. (Closes: #774313)
Author: Neil Williams <codehelp@debian.org>
Bug-Debian: https://bugs.debian.org/774313
Origin: ubuntu, https://launchpadlibrarian.net/177475074/doublefree.patch
---
--- libapache2-mod-auth-pgsql-2.0.3.orig/mod_auth_pgsql.c
+++ libapache2-mod-auth-pgsql-2.0.3/mod_auth_pgsql.c
@@ -489,6 +489,7 @@ PGconn *pg_connect(pg_auth_config_rec *s
"mod_auth_pgsql database connection error reset failed %s",
PQerrorMessage(conn));
PQfinish(conn);
+ conn = NULL;
return NULL;
}
}
@@ -562,6 +563,7 @@ char *do_pg_query(request_rec * r, char
"mod_auth_pgsql database character set encoding %s",
check);
PQfinish(pg_conn);
+ pg_conn = NULL;
return NULL;
}
}
@@ -573,12 +575,15 @@ char *do_pg_query(request_rec * r, char
"PGSQL 2: %s -- Query: %s ",
PQerrorMessage(pg_conn), query);
PQfinish(pg_conn);
+ pg_conn = NULL;
return NULL;
}
if (PQresultStatus(pg_result) == PGRES_EMPTY_QUERY) {
PQclear(pg_result);
+ pg_result = NULL;
PQfinish(pg_conn);
+ pg_conn = NULL;
return NULL;
}
@@ -586,7 +591,9 @@ char *do_pg_query(request_rec * r, char
apr_snprintf(pg_errstr, MAX_STRING_LEN, "PGSQL 3: %s -- Query: %s",
PQerrorMessage(pg_conn), query);
PQclear(pg_result);
+ pg_result = NULL;
PQfinish(pg_conn);
+ pg_conn = NULL;
return NULL;
}
@@ -596,7 +603,9 @@ char *do_pg_query(request_rec * r, char
apr_snprintf(pg_errstr, MAX_STRING_LEN, "PGSQL 4: %s",
PQerrorMessage(pg_conn));
PQclear(pg_result);
+ pg_result = NULL;
PQfinish(pg_conn);
+ pg_conn = NULL;
return NULL;
}
@@ -604,7 +613,9 @@ char *do_pg_query(request_rec * r, char
apr_snprintf(pg_errstr, MAX_STRING_LEN,
"Could not get memory for Postgres query.");
PQclear(pg_result);
+ pg_result = NULL;
PQfinish(pg_conn);
+ pg_conn = NULL;
return NULL;
}
@@ -613,7 +624,9 @@ char *do_pg_query(request_rec * r, char
/* ignore errors here ! */
PQclear(pg_result);
+ pg_result = NULL;
PQfinish(pg_conn);
+ pg_conn = NULL;
return result;
}
|
GitWeb