|
|
fix-use-after-free-in-OGo-webinterface.diff (1,390 bytes)
$OpenBSD$
release the object later, when it is really not in use anymore, fix for bug 5
--- sope-appserver/NGObjWeb/DynamicElements/WORepetition.m.orig Mon Aug 1 16:27:43 2011
+++ sope-appserver/NGObjWeb/DynamicElements/WORepetition.m Mon Aug 1 16:28:05 2011
@@ -840,7 +840,7 @@ _sapplyIndex(_WOSimpleRepetition *self, WOComponent *s
WOResponse_AddCString(_response, "<!-- repetition with no contents -->");
}
#endif
-
+ [array release];
[pool release];
#if DEBUG
$OpenBSD$
Fix use after free in OGo Webinterface, see bug: 5
--- sope-appserver/NGObjWeb/Associations/WOKeyPathAssociation.m.orig Tue Nov 2 15:12:12 2010
+++ sope-appserver/NGObjWeb/Associations/WOKeyPathAssociation.m Mon Aug 1 16:20:07 2011
@@ -727,7 +727,7 @@ _getValueN(WOKeyPathAssociation *self, unsigned _count
//NSLog(@"object %@ for keyPath %@", object, [self keyPath]);
- return object;
+ return [object retain];
}
static inline id _getValue(WOKeyPathAssociation *self, id root) {
@@ -742,8 +742,8 @@ static id _getOneValue(WOKeyPathAssociation *self, id
retValue = _getComponentValue(self, root, info);
return (info->type == WOKeyType_method)
- ? _objectify(info->retType, &retValue)
- : retValue.object;
+ ? [_objectify(info->retType, &retValue) retain]
+ : [retValue.object retain];
}
static inline void _getSetSelName(register unsigned char *buf,
|
|
|
|
Could someone look into this patch here? |
|
|
|
I don't really like those changes. It's normally the responsability of the caller to retain the object. Methods should generally return "autoreleased" objects. |
|
|
|
Thanks for looking into it, also for the other two.
I'll need to look into it again, will report back, but may take a while, need to prepare a setup where I can test again... |
|
|
|
patch-sope-appserver_NGObjWeb_DynamicElements_WORepetition_m (769 bytes)
$OpenBSD$
retain the array, to fix a use after free
see http://www.sogo.nu/bugs/view.php?id=1404
--- sope-appserver/NGObjWeb/DynamicElements/WORepetition.m.orig Tue Dec 6 13:52:00 2011
+++ sope-appserver/NGObjWeb/DynamicElements/WORepetition.m Tue Dec 6 13:53:35 2011
@@ -787,9 +787,9 @@ _sapplyIndex(_WOSimpleRepetition *self, WOComponent *s
pool = [[NSAutoreleasePool alloc] init];
sComponent = [_ctx component];
- array = [self->list valueInContext:_ctx];
+ array = [[self->list valueInContext:_ctx] retain];
aCount = [array count];
-
+
if (aCount > 0) {
unsigned cnt;
@@ -841,6 +841,7 @@ _sapplyIndex(_WOSimpleRepetition *self, WOComponent *s
}
#endif
+ [array release];
[pool release];
#if DEBUG
|
|
|
|
This new patch retains the array in the caller, and releases it at the end.
Hope this is better now and can get included in the next SOPE release. |
|
|
|
I was chasing another bug, and found, its a similar problem with the array, in a different method.
Updated patch fixes now fixes both problems for me. |
|
|
|
patch-sope-appserver_NGObjWeb_DynamicElements_WORepetition_m-new (1,369 bytes)
$OpenBSD$
retain the array, to fix a use after free
see http://www.sogo.nu/bugs/view.php?id=1404
--- sope-appserver/NGObjWeb/DynamicElements/WORepetition.m.orig Tue Dec 6 13:52:00 2011
+++ sope-appserver/NGObjWeb/DynamicElements/WORepetition.m Tue Dec 6 14:23:17 2011
@@ -479,7 +479,7 @@ _applyIndex(_WOComplexRepetition *self, WOComponent *s
doRender = ![_ctx isRenderingDisabled];
sComponent = [_ctx component];
- array = [self->list valueInContext:_ctx];
+ array = [[self->list valueInContext:_ctx] retain];
aCount = [array count];
startIdx = [self->startIndex unsignedIntValueInComponent:sComponent];
@@ -581,7 +581,7 @@ _applyIndex(_WOComplexRepetition *self, WOComponent *s
WOResponse_AddCString(_response, "<!-- repetition with no contents -->");
}
#endif
-
+ [array release];
[pool release];
#if DEBUG
@@ -787,9 +787,9 @@ _sapplyIndex(_WOSimpleRepetition *self, WOComponent *s
pool = [[NSAutoreleasePool alloc] init];
sComponent = [_ctx component];
- array = [self->list valueInContext:_ctx];
+ array = [[self->list valueInContext:_ctx] retain];
aCount = [array count];
-
+
if (aCount > 0) {
unsigned cnt;
@@ -841,6 +841,7 @@ _sapplyIndex(_WOSimpleRepetition *self, WOComponent *s
}
#endif
+ [array release];
[pool release];
#if DEBUG
|
|
|
|
since I just read on the mailing list, OSGo 1.3.11 will be release very shortly, could this be considered for inclusion?
We'd want to release a rc1 of ogo 5.5 maybe even before christmas, and it would greatly help to get rid of those two bugs with this patch.
thanks,
Sebastian |
|
|
|
Fixed push, thanks!
See: http://mtn.inverse.ca/revision/diff/7ebce8df2ddbe7d6cbc534f7c1e7d64ebbc73a72/with/1f44a0d5895a6e34af5e973ae98a48b118eb7cd8 |
|
