The receive_xattr() function in rsync uses a wire-supplied count value for qsort() that may exceed the number of valid items after xattr filtering. This leads to use-after-free conditions when stale array entries are processed, causing double-free or free-of-allocated-memory scenarios during xattr handling.
| Vendor | Product | Versions |
|---|---|---|
| — | rsync | 3.0.1 - 3.4.1 |
