View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0010107 | Taler | qtart | public | 2025-06-15 11:12 | 2025-08-31 17:09 |
| Reporter | oec | Assigned To | Florian Dold | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | urgent | Severity | crash | Reproducibility | random |
| Status | closed | Resolution | fixed | ||
| Product Version | git (master) | ||||
| Target Version | 1.0 stretch goals | Fixed in Version | 1.0 stretch goals | ||
| Summary | 0010107: call of js_free on uninitialized pointer | ||||
| Description | In quickjs-libc.c, function `js_os_post_message_from_host`: ```c 4452 int 4453 js_os_post_message_from_host(JSContext *ctx, const char *msg_str) 4454 { 4455 JSThreadState *ts = JS_GetRuntimeOpaque(JS_GetRuntime(ctx)); 4456 JSHostMessage *msg; 4457 JSHostMessagePipe *hp; 4458 uint8_t *data; 4459 ... 4491 js_free(ctx, data); 4492 return -1; 4493 } ``` `data` is never initialized. Yet, it is freed in line 4491. This might lead to a crash of qtart. | ||||
| Additional Information | The compiler had warned me. Why has this not been fixed already!? | ||||
| Tags | security | ||||
| commit be93b6ac80f366d400abe7aaffb1e53d231cae32 (HEAD -> master, origin/master, origin/HEAD) Author: Florian Dold <florian@dold.me> Date: Tue Jun 17 00:35:18 2025 +0200 fix 0010107: call of js_free on uninitialized pointer | |
| Looks like only clang detects this with default warnings, gcc doesn't! That's why we didn't notice/fix this earlier. | |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2025-06-15 11:12 | oec | New Issue | |
| 2025-06-15 11:17 | oec | Description Updated | |
| 2025-06-15 12:58 | Christian Grothoff | Assigned To | => Florian Dold |
| 2025-06-15 12:58 | Christian Grothoff | Priority | normal => urgent |
| 2025-06-15 12:58 | Christian Grothoff | Status | new => assigned |
| 2025-06-15 12:58 | Christian Grothoff | Target Version | => 1.0 stretch goals |
| 2025-06-15 12:58 | Christian Grothoff | Tag Attached: security | |
| 2025-06-16 22:35 | Florian Dold | Note Added: 0025266 | |
| 2025-06-16 22:35 | Florian Dold | Note Added: 0025267 | |
| 2025-06-16 22:36 | Florian Dold | Status | assigned => informing |
| 2025-06-16 22:36 | Florian Dold | Resolution | open => fixed |
| 2025-06-29 21:27 | Christian Grothoff | Fixed in Version | => 1.0 stretch goals |
| 2025-08-31 17:09 | Christian Grothoff | Status | informing => closed |