Commits on Oct 8, 2020

1. src: fix freeing unintialized pointer bug in ParseSoaReply …

   ares_expand_name doesn't guarantee that pointer variable is initialized
   if return code is ARES_EBADNAME or ARES_ENOMEM. But current usage of the
   function in the codebase thinks otherwise.
   
   There seems to be an assumption that pointer is always initialized even
   though it is a local variable and we create a unique pointer soon after
   calling ares_expand_name. This could potentially crash the program with
   an invalid free pointer.
   
   I was able to crash it by poisoning the memory and some manual hooks.
   
   By moving the unique_ptr after checking the return code we can fix the
   problem. As the underlying function guarantees that pointer is
   initialized when the status is ARES_SUCCESS.
   
   PR-URL: nodejs#35502
   Reviewed-By: Anna Henningsen <anna@addaleax.net>
   Reviewed-By: Rich Trott <rtrott@gmail.com>

   

   AasthaGupta authored and Trott committed Oct 8, 2020
   Copy the full SHA

   0f41bca View commit details

   Browse the repository at this point in the history