Buy commercial curl support. We
help you work out your issues, debug your libcurl applications, use the API,
port to new platforms, add new features and more. With a team lead by the
curl founder Daniel himself.
Re: Some questions about CVE-2022-42915
- Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]
From: Daniel Stenberg via curl-library <curl-library_at_lists.haxx.se>
Date: Sun, 22 Dec 2024 14:12:41 +0100 (CET)
On Sun, 22 Dec 2024, ³ÂÐÇèÆ via curl-library wrote:
> Good morning! Sorry to bother you. I notice that CVE-2022-42915 is a double
> free vulnerability. So the introduce commit should include two free
> operation.
That sounds far too naive to work as a test for if the commit is legit or not
as the commit introducing that problem. Double-free only requries that the
same pointer is freed twice, it could be completely unrelated to how many
frees or not that were added in a given commit. It is about code flows and
what is called how etc.
If you want us to change the documentation to say to another commit, I think
you need to propose this with more confidence than "one of them introduce two
free calls".
For example, how about you run actual code against the two different versions
to see when the bug can trigger or not?
Date: Sun, 22 Dec 2024 14:12:41 +0100 (CET)
On Sun, 22 Dec 2024, ³ÂÐÇèÆ via curl-library wrote:
> Good morning! Sorry to bother you. I notice that CVE-2022-42915 is a double
> free vulnerability. So the introduce commit should include two free
> operation.
That sounds far too naive to work as a test for if the commit is legit or not
as the commit introducing that problem. Double-free only requries that the
same pointer is freed twice, it could be completely unrelated to how many
frees or not that were added in a given commit. It is about code flows and
what is called how etc.
If you want us to change the documentation to say to another commit, I think
you need to propose this with more confidence than "one of them introduce two
free calls".
For example, how about you run actual code against the two different versions
to see when the bug can trigger or not?
-- / daniel.haxx.se || https://rock-solid.curl.dev
-- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library Etiquette: https://curl.se/mail/etiquette.htmlReceived on 2024-12-22