Re: Some questions about CVE-2022-42915
Daniel Stenberg via curl-library <[email protected]>
| Newsgroups | gmane.comp.web.curl.library |
|---|---|
| Message-ID | <[email protected]> |
On Sun, 22 Dec 2024, 鲁猫 via curl-library wrote: > Good morning! Sorry to bother you. I notice that CVE-2022-42915 is a double > free vulnerability. So the introduce commit should include two free > operation. That sounds far too naive to work as a test for if the commit is legit or not as the commit introducing that problem. Double-free only requries that the same pointer is freed twice, it could be completely unrelated to how many frees or not that were added in a given commit. It is about code flows and what is called how etc. If you want us to change the documentation to say to another commit, I think you need to propose this with more confidence than "one of them introduce two free calls". For example, how about you run actual code against the two different versions to see when the bug can trigger or not? -- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library Etiquette: https://curl.se/mail/etiquette.html