[sr-dev] git:master:6e260446: sqlops: fix use-after-free by deep copying result name

[Timo Teräs]

Module: kamailio
Branch: master
Commit: 6e2604464e64cfaaf1e0327228f53f4787b69470
URL: https://github.com/kamailio/kamailio/commit/6e2604464e64cfaaf1e0327228f53f4787b69470

Author: Timo Teräs <timo.teras at iki.fi>
Committer: Timo Teräs <timo.teras at iki.fi>
Date: 2015-04-16T12:08:20+03:00

sqlops: fix use-after-free by deep copying result name

When creating a new result handle, deep copy the result name.
Otherwise we might end up accessing the name after it's freed.

---

Modified: modules/sqlops/sql_api.c

---

Diff:  https://github.com/kamailio/kamailio/commit/6e2604464e64cfaaf1e0327228f53f4787b69470.diff
Patch: https://github.com/kamailio/kamailio/commit/6e2604464e64cfaaf1e0327228f53f4787b69470.patch

---

diff --git a/modules/sqlops/sql_api.c b/modules/sqlops/sql_api.c
index cf0efee..db87fbf 100644
--- a/modules/sqlops/sql_api.c
+++ b/modules/sqlops/sql_api.c
@@ -197,14 +197,16 @@ sql_result_t* sql_get_result(str *name)
 			return sr;
 		sr = sr->next;
 	}
-	sr = (sql_result_t*)pkg_malloc(sizeof(sql_result_t));
+	sr = (sql_result_t*)pkg_malloc(sizeof(sql_result_t) + name->len);
 	if(sr==NULL)
 	{
 		LM_ERR("no pkg memory\n");
 		return NULL;
 	}
 	memset(sr, 0, sizeof(sql_result_t));
-	sr->name = *name;
+	memcpy(sr+1, name->s, name->len);
+	sr->name.s = (char *)(sr + 1);
+	sr->name.len = name->len;
 	sr->resid = resid;
 	sr->next = _sql_result_root;
 	_sql_result_root = sr;
@@ -683,6 +685,7 @@ void sql_destroy(void)
 		pkg_free(r);
 		r = r0;
 	}
+	_sql_result_root = NULL;
 }
 
 /**