<fswebcam> [BUG] An use after free bug in src_v41_set_read.c
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 4.6k
- Forks
- 4k
- Avg merge
- 3d 12h
- Merged PRs (30d)
- 134
Description
Maintainer: Nicolas Thill nico@openwrt.org
Environment: 22.3
Description:
File: src_v41_set_read.c
Bug Function: src_v4l_open
Version: openwrt maintained fswebcam
In line 788-792
if(src->use_read && src_v4l_set_read(src))
{
src_v4l_close(src);
return(-1);
}
In the src_v4l_set_read, if in line 667 s->buffer = malloc(s->buffer_length); failed, it will release src in line 671 and return -1. So in line 788, if src->use_read != NULL, line 790 will be executed, which will lead to UAF
Suggestion:
This bug has been fixed in the fdm-master on github yesterday.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src_v41_set_read.c at src_v4l_open and src_v4l_set_read, especially lines 667-671 and 788-792, to trace ownership when buffer allocation fails. Compare the corresponding fix in the fswebcam fdm-master branch; done means the allocation-failure path no longer leads to use-after-free when src->use_read is enabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- embedded-iot, operating-systems
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100