admin/libiscsi
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

test-tool: Avoid that using receive_copy_results() triggers a use-after-free

Browse Source 
Move the scsi_free_scsi_task() call from receive_copy_results() to the
callers of this function to avoid that accessing the unmarshalled data
triggers a use-after-free.

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
This commit is contained in:
Bart Van Assche
2015-09-26 20:51:49 -07:00
committed by Ronnie Sahlberg
parent cacc144a29
commit be9b803334
5 changed files with 42 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
test-tool/test_receive_copy_results_copy_status.c
View File

@@ -30,6 +30,7 @@ void
test_receive_copy_results_copy_status(void)
{
int ret;
struct scsi_task *cs_task;
struct scsi_copy_results_copy_status *csp;
int tgt_desc_len = 0, seg_desc_len = 0;
int offset = XCOPY_DESC_OFFSET, list_id = 1;
@@ -40,12 +41,14 @@ test_receive_copy_results_copy_status(void)
logging(LOG_VERBOSE, "Test RECEIVE COPY RESULTS, COPY STATUS");
logging(LOG_VERBOSE, "No copy in progress");
ret = receive_copy_results(sd, SCSI_COPY_RESULTS_COPY_STATUS,
ret = receive_copy_results(&cs_task, sd, SCSI_COPY_RESULTS_COPY_STATUS,
list_id, NULL, EXPECT_INVALID_FIELD_IN_CDB);
scsi_free_scsi_task(cs_task);
cs_task = NULL;
if (ret == -2) {
CU_PASS("[SKIPPED] Target does not support "
"RECEIVE_COPY_STATUS. Skipping test");
return;
goto out;
}
CU_ASSERT_EQUAL(ret, 0);
@@ -77,13 +80,16 @@ test_receive_copy_results_copy_status(void)
if (ret == -2) {
CU_PASS("[SKIPPED] Target does not support "
"EXTENDED_COPY. Skipping test");
return;
goto out;
}
CU_ASSERT_EQUAL(ret, 0);
logging(LOG_VERBOSE,
"Copy Status for the above Extended Copy command");
ret = receive_copy_results(sd, SCSI_COPY_RESULTS_COPY_STATUS,
ret = receive_copy_results(&cs_task, sd, SCSI_COPY_RESULTS_COPY_STATUS,
list_id, (void **)&csp, EXPECT_STATUS_GOOD);
CU_ASSERT_EQUAL(ret, 0);
out:
scsi_free_scsi_task(cs_task);
}