https://github.com/RsyncProject/rsync/pull/706 From f923b19fd85039a2b0e908391074872334646d51 Mon Sep 17 00:00:00 2001 From: Natanael Copa Date: Wed, 15 Jan 2025 15:48:04 +0100 Subject: [PATCH] Fix use-after-free in generator full_fname() will free the return value in the next call so we need to duplicate it before passing it to rsyserr. Fixes: https://github.com/RsyncProject/rsync/issues/704 --- generator.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/generator.c b/generator.c index 3f13bb95..b56fa569 100644 --- a/generator.c +++ b/generator.c @@ -2041,8 +2041,12 @@ int atomic_create(struct file_struct *file, char *fname, const char *slnk, const if (!skip_atomic) { if (do_rename(tmpname, fname) < 0) { + char *full_tmpname = strdup(full_fname(tmpname)); + if (full_tmpname == NULL) + out_of_memory("atomic_create"); rsyserr(FERROR_XFER, errno, "rename %s -> \"%s\" failed", - full_fname(tmpname), full_fname(fname)); + full_tmpname, full_fname(fname)); + free(full_tmpname); do_unlink(tmpname); return 0; }