#50830 Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
Merged a month ago by mreynolds. Opened a month ago by mreynolds.
mreynolds/389-ds-base issue50829  into  master

@@ -3259,6 +3259,12 @@ 

          logp = logp->l_next;

          slapi_ch_free((void **)&prev_log);



+     /* reset the log struct */

+     loginfo.log_access_logchain = NULL;

+     loginfo.log_audit_logchain = NULL;

+     loginfo.log_auditfail_logchain = NULL;

+     loginfo.log_error_logchain = NULL;



  #define ERRORSLOG 1


When Disk Monitoring finds that disk space is too low it starts freeing up disk space by removing rotated logs. However the log list struct was not properly reset after freeing all the files in the list. This is what allowed the heap-use-after-free to occur.

relates: https://pagure.io/389-ds-base/issue/50829

rebased onto bb3ac59

a month ago

Pull-Request has been merged by mreynolds

a month ago