* mod_authn_dbd: apr_pstrdup dbd_password and dbd_hash to fix use-after-free

Jan Kaluža · Jan Kaluža · commit 228a45dafece · 2015-03-03T11:12:18.000Z
bug with postgresql git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1663647 13f79535-47bb-0310-9956-ffa450edef68
diff --git a/modules/aaa/mod_authn_dbd.c b/modules/aaa/mod_authn_dbd.c
@@ -174,7 +174,8 @@ static authn_status authn_dbd_password(request_rec *r, const char *user,
                 i++;
             }
 #endif
-            dbd_password = apr_dbd_get_entry(dbd->driver, row, 0);
+            dbd_password = apr_pstrdup(r->pool,
+                                       apr_dbd_get_entry(dbd->driver, row, 0));
         }
         /* we can't break out here or row won't get cleaned up */
     }
@@ -269,7 +270,8 @@ static authn_status authn_dbd_realm(request_rec *r, const char *user,
                 i++;
             }
 #endif
-            dbd_hash = apr_dbd_get_entry(dbd->driver, row, 0);
+            dbd_hash = apr_pstrdup(r->pool,
+                                   apr_dbd_get_entry(dbd->driver, row, 0));
         }
         /* we can't break out here or row won't get cleaned up */
     }

Original file line number	Diff line number	Diff line change
`@@ -174,7 +174,8 @@ static authn_status authn_dbd_password(request_rec r, const char user,`
`174`	`174`	`i++;`
`175`	`175`	`}`
`176`	`176`	`#endif`
`177`		`- dbd_password = apr_dbd_get_entry(dbd->driver, row, 0);`
	`177`	`+ dbd_password = apr_pstrdup(r->pool,`
	`178`	`+ apr_dbd_get_entry(dbd->driver, row, 0));`
`178`	`179`	`}`
`179`	`180`	`/* we can't break out here or row won't get cleaned up */`
`180`	`181`	`}`
`@@ -269,7 +270,8 @@ static authn_status authn_dbd_realm(request_rec r, const char user,`
`269`	`270`	`i++;`
`270`	`271`	`}`
`271`	`272`	`#endif`
`272`		`- dbd_hash = apr_dbd_get_entry(dbd->driver, row, 0);`
	`273`	`+ dbd_hash = apr_pstrdup(r->pool,`
	`274`	`+ apr_dbd_get_entry(dbd->driver, row, 0));`
`273`	`275`	`}`
`274`	`276`	`/* we can't break out here or row won't get cleaned up */`
`275`	`277`	`}`