From 6c016dc54a5b7e3033d7448bc2628bc5a24d660c Mon Sep 17 00:00:00 2001 From: Murai Takashi Date: Fri, 13 Nov 2020 21:28:31 +0900 Subject: [PATCH] libnetapi: Fix use after free MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix 'fImpl' is used after delete in BNetBuffer::operator= (GetImpl() returns fImpl), when it is used with self assignment. Pointed out by Clang Static Analyzer. Change-Id: Ic80a4ce73879062581b9241f84a4340919d281b9 Reviewed-on: https://review.haiku-os.org/c/haiku/+/3393 Reviewed-by: Jérôme Duval --- src/kits/network/libnetapi/NetBuffer.cpp | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/src/kits/network/libnetapi/NetBuffer.cpp b/src/kits/network/libnetapi/NetBuffer.cpp index bc157f6877..ce036db3ca 100644 --- a/src/kits/network/libnetapi/NetBuffer.cpp +++ b/src/kits/network/libnetapi/NetBuffer.cpp @@ -66,12 +66,13 @@ BNetBuffer::BNetBuffer(BMessage* archive) : BNetBuffer& BNetBuffer::operator=(const BNetBuffer& buffer) { - delete fImpl; - - fImpl = new (std::nothrow) DynamicBuffer(*buffer.GetImpl()); - if (fImpl != NULL) - fInit = fImpl->InitCheck(); + if (&buffer != this) { + delete fImpl; + fImpl = new (std::nothrow) DynamicBuffer(*buffer.GetImpl()); + if (fImpl != NULL) + fInit = fImpl->InitCheck(); + } return *this; }