Parcourir la source

Avoid potential use-after-free bug

Baptiste Jonglez il y a 7 ans
Parent
commit
5d1c2b257a
1 fichiers modifiés avec 4 ajouts et 2 suppressions
  1. 4 2
      src/callouts.cc

+ 4 - 2
src/callouts.cc

@@ -74,7 +74,8 @@ void extract_subnet4(std::vector<std::string>& env, const Subnet4Ptr subnet)
 {
     env.push_back("KEA_SUBNET4=" + subnet->toText());
     std::pair<isc::asiolink::IOAddress, uint8_t> prefix = subnet->get();
-    env.push_back("KEA_SUBNET4_PREFIX=" + prefix.first.toText());
+    /* Copy string to avoid use-after-free when we return from this function */
+    env.push_back("KEA_SUBNET4_PREFIX=" + std::string(prefix.first.toText()));
     env.push_back("KEA_SUBNET4_PREFIXLEN=" + std::to_string(prefix.second));
 }
 
@@ -82,7 +83,8 @@ void extract_subnet6(std::vector<std::string>& env, const Subnet6Ptr subnet)
 {
     env.push_back("KEA_SUBNET6=" + subnet->toText());
     std::pair<isc::asiolink::IOAddress, uint8_t> prefix = subnet->get();
-    env.push_back("KEA_SUBNET6_PREFIX=" + prefix.first.toText());
+    /* Copy string to avoid use-after-free when we return from this function */
+    env.push_back("KEA_SUBNET6_PREFIX=" + std::string(prefix.first.toText()));
     env.push_back("KEA_SUBNET6_PREFIXLEN=" + std::to_string(prefix.second));
 }