lib: talloc: As _tc_free_internal() takes a struct talloc_chunk *, add an extra paran...
authorAndrew Bartlett <abartlet@samba.org>
Wed, 29 Jun 2016 23:44:50 +0000 (16:44 -0700)
committerJeremy Allison <jra@samba.org>
Sun, 3 Jul 2016 12:26:17 +0000 (14:26 +0200)
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
lib/talloc/talloc.c

index 428fb8a..cd0ec3d 100644 (file)
@@ -1034,6 +1034,20 @@ static inline int _tc_free_internal(struct talloc_chunk *tc,
 
        if (unlikely(tc->destructor)) {
                talloc_destructor_t d = tc->destructor;
+
+               /*
+                * Protect the destructor against some overwrite
+                * attacks, by explicitly checking it has the right
+                * magic here.
+                */
+               if (talloc_chunk_from_ptr(ptr) != tc) {
+                       /*
+                        * This can't actually happen, the
+                        * call itself will panic.
+                        */
+                       TALLOC_ABORT("talloc_chunk_from_ptr failed!");
+               }
+
                if (d == (talloc_destructor_t)-1) {
                        return -1;
                }