Tag: f2d2420bbf4bb125ea5f2e1573d4da6b668fc78a

SA1111: Eliminate use after free

Author: Julia Lawall <julia@diku.dk> __sa1111_remove always frees its argument, so the subsequent reference to sachip->saved_state represents a use after free. __sa1111_remove does not appear to use the saved_state field, so the patch simply frees it first. A simplified version of the semantic patch that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @@ expression E,E2; …

Continue reading