Subject: bug#68421: closed (Re: bug#68421: Possible use after free in w32notify.c)

From: [email-masked] (GNU bug Tracking System)
Date: Sat, 13 Jan 2024 09:26:01 +0000

Your bug report

#68421: Possible use after free in w32notify.c

which was filed against the emacs package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
68421: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=68421
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#68421: Possible use after free in w32notify.c
From: Stefan Kangas <[email-masked]>
To: Eli Zaretskii <[email-masked]>
Cc: [email-masked]
Date: Sat, 13 Jan 2024 03:25:44 -0600
List-Id: <debbugs-submit.debbugs.gnu.org>

Version: 30.1

Eli Zaretskii <[email-masked]> writes:

>> From: Stefan Kangas <[email-masked]>
>> Date: Sat, 13 Jan 2024 01:49:36 -0600
>>
>> Could someone familiar with w32notify.c look over the attached patch?
>>
>> It looks like we are trying to dereference NULL in add_watch, and
>> returning an already freed value from start_watching.
>
> Feel free to install on master, and thanks.

Thanks, done in commit 893829021bd.

Subject: Possible use after free in w32notify.c
From: Stefan Kangas <[email-masked]>
To: [email-masked]
Date: Sat, 13 Jan 2024 01:49:36 -0600
List-Id: <debbugs-submit.debbugs.gnu.org>

Could someone familiar with w32notify.c look over the attached patch?

It looks like we are trying to dereference NULL in add_watch, and
returning an already freed value from start_watching.
diff --git a/src/w32notify.c b/src/w32notify.c
index 9f8a62a1daa..c93e8796fe2 100644
--- a/src/w32notify.c
+++ b/src/w32notify.c
@@ -350,6 +350,7 @@ start_watching (const char *file, HANDLE hdir, BOOL subdirs, DWORD flags)
       xfree (dirwatch->io_info);
       xfree (dirwatch->watchee);
       xfree (dirwatch);
+      return NULL;
     }
   return dirwatch;
 }
@@ -412,10 +413,7 @@ add_watch (const char *parent_dir, const char *file, BOOL subdirs, DWORD flags)
     return NULL;
 
   if ((dirwatch = start_watching (file, hdir, subdirs, flags)) == NULL)
-    {
-      CloseHandle (hdir);
-      dirwatch->dir = NULL;
-    }
+    CloseHandle (hdir);
 
   return dirwatch;
 }