Skip to content

Commit deac203

Browse files
committed
fs/smb/client: Reset password pointer to NULL
jira VULN-9356 cve CVE-2023-5345 commit-author Quang Le <[email protected]> commit e6e43b8 upstream-diff The mainline `e6e43b8a' commit consisting of a single line `ctx->password = NULL' is a fix of commit `a4e430c8c8ba96be8c6ec4f2eb108bb8bcbee069' (not mentioned anywhere), whose erroneous code is not present in `ciqlts9_2-rt', so the fix doesn't apply. The `a4e430c8' commit can be treated as a vulnerability patch itself (erasing passwords stored on heap upon freeing, thus ensuring that no secrets linger in RAM). However, it's not a part of CVE-2023-5345, or any other CVE for that matter. Forget to reset ctx->password to NULL will lead to bug like double free Cc: [email protected] Cc: Willy Tarreau <[email protected]> Reviewed-by: Namjae Jeon <[email protected]> Signed-off-by: Quang Le <[email protected]> Signed-off-by: Steve French <[email protected]> (cherry picked from commit e6e43b8) Signed-off-by: Marcin Wcisło <[email protected]>
1 parent bb1b0a8 commit deac203

File tree

0 file changed

+0
-0
lines changed

    0 file changed

    +0
    -0
    lines changed

    0 commit comments

    Comments
     (0)