Skip to content

Commit 7cb67b0

Browse files
committed
Fixed use after free in ModSecurity::processContentOffset
- Use after free issue detected with Address Sanitizer while running the reading_logs_with_offset example. - Keeps reference to last element in vars vector with vars.back(). Then it removes the element from vars calling vars.pop_back() which invalidates the reference, but it's accessed later in the function. - Fixed by copying the value instead.
1 parent fc68a23 commit 7cb67b0

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

src/modsecurity.cc

+4-4
Original file line numberDiff line numberDiff line change
@@ -262,9 +262,9 @@ int ModSecurity::processContentOffset(const char *content, size_t len,
262262
std::string value;
263263
yajl_gen_map_open(g);
264264
vars.pop_back();
265-
const std::string &startingAt = vars.back().str();
265+
const std::string startingAt = vars.back().str();
266266
vars.pop_back();
267-
const std::string &size = vars.back().str();
267+
const std::string size = vars.back().str();
268268
vars.pop_back();
269269
yajl_gen_string(g,
270270
reinterpret_cast<const unsigned char*>("startingAt"),
@@ -346,9 +346,9 @@ int ModSecurity::processContentOffset(const char *content, size_t len,
346346
strlen("highlight"));
347347
yajl_gen_map_open(g);
348348
ops.pop_back();
349-
std::string startingAt = ops.back().str();
349+
const std::string startingAt = ops.back().str();
350350
ops.pop_back();
351-
std::string size = ops.back().str();
351+
const std::string size = ops.back().str();
352352
ops.pop_back();
353353
yajl_gen_string(g,
354354
reinterpret_cast<const unsigned char*>("startingAt"),

0 commit comments

Comments
 (0)