[prev in list] [next in list] [prev in thread] [next in thread] 

List:       hostap
Subject:    Re: [PATCH v2] Fix use after free warning introduced by gcc 12.1
From:       Krishna Chaitanya <chaitanya.mgit () gmail ! com>
Date:       2023-04-29 18:46:57
Message-ID: CABPxzY++AxjUZ5PrtbLChpfOUQUt-DAtPDiLOqgXstA=GGPpVA () mail ! gmail ! com
[Download RAW message or body]

On Fri, Apr 28, 2023 at 9:09 PM Jouni Malinen <j@w1.fi> wrote:
> 
> On Fri, Apr 21, 2023 at 12:58:21AM +0530, Krishna wrote:
> > gcc 12.1 complains about using pointer after realloc as it could
> > potentially be moved/freed, causing any uses after UB.
> > 
> > Fix this by doing checks before alloc and use those statuses and update
> > with new BSS.
> 
> Could you please provide the exact warning message produced by the
> compiler? gcc 12.1 did not complain about anything in my test setup when
> compiling wpa_supplicant, so I'm assuming this would need some extra
> warnings to be enabled.

../../../../../modules/lib/hostap/wpa_supplicant/bss.c:701:25: error:
pointer 'bss' may be used after 'realloc' [-Werror=use-after-free]
701 | wpa_bss_update_pending_connect(wpa_s, bss, nbss);

> 
> As far as the "use of a pointer after realloc" is concerned, it should
> be noted that the implementation here does not dereference the old
> pointer after the realloc() call. What is being done here is a
> check of whether the buffer was indeed moved by comparing the pointer
> values before and after the realloc call. Is that really UB or is that
> an excessive warning from the compiler?
Well, the code looks fine, but as the pointer after realloc might not
exist, compiler
can optimize the code causing indeterminate behaviour. This is discussed
here https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104069 and
https://www.reddit.com/r/C_Programming/comments/vffgpo/comment/icvvw8e/?utm_source=share&utm_medium=web2x&context=3


_______________________________________________
Hostap mailing list
Hostap@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/hostap


[prev in list] [next in list] [prev in thread] [next in thread]