BUG in insmod-1.3.69f

Alberto Vignani (alberto.vignani@torino.alpcom.it)
Thu, 02 May 1996 23:07:50 +0000 (GMT)


Hi.

I discovered a bug in the latest insmod. When you pass string arguments to
a module, a pointer is first (re)allocated, then used inside a loop which
increments it, finally freed. This causes a segfault. Use a local variable
instead:

-----------------------------------------------------------------------------
--- insmod.c.old Fri May 3 00:59:47 1996
+++ insmod.c Fri May 3 00:57:04 1996
@@ -288,6 +288,7 @@
char spare_path[200]; /* just testing... */
char *modname = NULL;
char *otextseg; /* JEJB: store the initial textseg, so we get offset */
+ struct strpatch *sps2;
char *p;

/* find basename */
@@ -755,6 +756,8 @@
/*
* Patch in any new strings from the command line
*/
+ sps2 = stringpatches;
+
while (n_stringpatches > 0) {
/*
* Now we have to calculate the "absolute" address of the
@@ -762,9 +765,9 @@
*
* Timo Kokkonen <timo@cs.ualberta.ca>
*/
- *((int *)(textseg + stringpatches->where)) =
- addr + stringpatches->what; /* kernel address */
- ++stringpatches;
+ *((int *)(textseg + sps2->where)) =
+ addr + sps2->what; /* kernel address */
+ ++sps2;
--n_stringpatches;
}
if (stringpatches)
-----------------------------------------------------------------------------

Alberto