Open kydahe opened 2 years ago
感谢指出。
IOT_Shadow_Destroy()
会对入参进行检查,不会有重复释放的风险
int IOT_Shadow_Destroy(void *handle)
{
IOT_FUNC_ENTRY;
POINTER_SANITY_CHECK(handle, QCLOUD_ERR_INVAL);
感谢指出。
- 确实存在问题,下一版本修复
IOT_Shadow_Destroy()
会对入参进行检查,不会有重复释放的风险int IOT_Shadow_Destroy(void *handle) { IOT_FUNC_ENTRY; POINTER_SANITY_CHECK(handle, QCLOUD_ERR_INVAL);
- 下一版本修复
我认为对于Bug2 的问题是存在的,IOT_Shadow_Destroy()
中的参数检查并没有生效。且此问题不仅会造成Double Free,也会造成UAF!请修复此问题。
理由如下:
IOT_Shadow_Destroy()
中POINTER_SANITY_CHECK
检查的定义,可以看出来此check仅对在指针为空时报错。
#define POINTER_SANITY_CHECK(ptr, err) \
do { \
if (NULL == (ptr)) { \
Log_e("Invalid argument, %s = %p", #ptr, ptr); \
return (err); \
} \
} while (0)
在第169行对shadow_client
进行了非空验证,所以第180行处shadow_client
一定非空 且被释放,随后直接跳转到thread_exit分支,并在第225行处仍然非空,IOT_Shadow_Destroy()
中的check并未生效!随后被释放第二次!
static void _shadow_client_thread_runner(void *ptr)
{
int rc = QCLOUD_ERR_FAILURE;
void *shadow_client = NULL;
...
shadow_client = IOT_Shadow_Construct(&init_params);
if (shadow_client == NULL) { //----------------------> line 169
Log_e("shadow client constructed failed.");
goto thread_exit;
}
// register delta property
shadow_property.key = thread_data->property_key;
shadow_property.data = ¤t_update_count;
shadow_property.type = JINT32;
rc = IOT_Shadow_Register_Property(shadow_client, &shadow_property, OnDeltaCallback);
if (rc != QCLOUD_RET_SUCCESS) {
rc = IOT_Shadow_Destroy(shadow_client); //------------------->line 180
//!!! shadow_client memory was freed via IOT_Shadow_Destroy
Log_e("register device shadow property failed, err: %d", rc);
goto thread_exit;
}
...
thread_exit:
if (shadow_client != NULL) { // -------------------------->line 225
IOT_Shadow_Destroy(shadow_client); //!!! shadow_client memory was freed via IOT_Shadow_Destroy again since it was freed before.
shadow_client = NULL;
}
sg_thread_status[thread_id] = 1;
}
samples/mqtt/multi_thread_mqtt_sample.c,ota_mqtt_sample.c存在内存UAF (memory Use-After-Free) 安全问题(即使用了一个已经释放的内存)。 multi_client_shadow_sample.c, ota_mqtt_sample.c存在DF(memory Double Free)安全问题(即对内存进行双重释放)。