FS#3016 : libubox: read of freed memory in runqueue_task_kill()
bugs.openwrt.org › indexApr 18, 2020 · FS#3016 - libubox: read of freed memory in runqueue_task_kill () I believe there is a use-after-free bug in runqueue.c:runqueue_task_kill (). If a task is killed by calling runqueue_task_kill (), the ‘complete’ callback will be called when runqueue_task_complete () is called, which, in the case of test-runqueue.c at least, is where ...
git.openwrt.org Git - project/libubox.git/log
git.openwrt.orgJul 03, 2017 · libubox: runqueue: fix use-after-free bug Fixes a use-after-free bug in runqueue_task_kill(): Invalid read of size 8 at runqueue_task_kill (runqueue.c:200) by uloop_process_timeouts (uloop.c:505) by uloop_run_timeout (uloop.c:542) by uloop_run (uloop.h:111) by main (tests/test-runqueue.c:126) Address 0x5a4b058 is 24 bytes inside a block of size ...