OPENAFS-SA-2024-002: viced: Free ACL on acl_Internalize_pr error 30/15930/2
authorAndrew Deason <adeason@sinenomine.net>
Mon, 18 Sep 2023 21:14:07 +0000 (16:14 -0500)
committerBenjamin Kaduk <kaduk@mit.edu>
Tue, 12 Nov 2024 18:05:30 +0000 (13:05 -0500)
commita07e50726df09c49dfe7b953c3e49eb98f310c09
treed9092d557f5115fdf6a6def41d439e595edab9ae
parentf74f960a18f559e683d6a1f5104e43c3ca93ecb8
OPENAFS-SA-2024-002: viced: Free ACL on acl_Internalize_pr error

CVE-2024-10396

Currently, we don't free 'newACL' if acl_Internalize_pr() fails. If
acl_Internalize_pr() has already allocated 'newACL', then the memory
associated with newACL will be leaked. This can happen if parsing the
given ACL fails at any point after successfully parsing the first
couple of lines in the ACL.

Change acl_FreeACL() to make freeing a NULL acl a no-op, to make it
easier to make sure the acl has been freed.

FIXES 135445

Reviewed-on: https://gerrit.openafs.org/15909
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>
(cherry picked from commit f4dfc2d7183f126bc4a45b5cabc78c3de020925f)

Change-Id: If1554aa899542761ec6e6611394f2ee4f9379f22
Reviewed-on: https://gerrit.openafs.org/15930
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>
src/libacl/aclprocs.c
src/viced/afsfileprocs.c