search

trustedsec / CS-Situational-Awareness-BOF

Situational Awareness commands implemented using Beacon Object Files
GNU General Public License v2.0
1.26k stars 218 forks source link

Potential wild free on WLDAP32$ldap_value_free(ppValue);? #12

Closed JohnLaTwC closed 4 years ago

JohnLaTwC commented 4 years ago

I am not a C++ expert, but I would suggest an additional look at this free: https://github.com/trustedsec/CS-Situational-Awareness-BOF/blob/b6de70e08884c7597898b478fd488a38c118d1e7/src/SA/ldapsearch/entry.c#L319

All the other variables being freed are declared and initialized at function entry. However, ppValue is not declared or initialized until line 228: https://github.com/trustedsec/CS-Situational-Awareness-BOF/blob/b6de70e08884c7597898b478fd488a38c118d1e7/src/SA/ldapsearch/entry.c#L228

There are several code paths which skip this declaration and initialization, notably on lines lines 182, 193, 201, 213, 218, which goto end on error conditions. If the initialization of ppValue was skipped by the goto, ldap_value_free may be called on an uninitialized variable and hence a wild free.

freefirex commented 4 years ago

Very good find, I missed that one in my review. I appreciate you pointing this out!