buffer overflow in 2.41

[dirkmueller]

There is a swapped parameter in parse_ask_file:

1. In parse_ask_file, posix_memalign((void**)&req, sizeof(void*), alignof(struct request)) allocates alignof(struct request) bytes instead of sizeof(struct request) bytes. This allocates only 8 bytes on 64-bit systems instead of the required structure size, causing heap-based buffer overflows on member accesses.
2. The allocated structure req is never zeroed or initialized. Its members contain garbage memory, leading to use of uninitialized values.
3. If req->message is uninitialized or evaluated as false, free(req->socket_path) is called on an uninitialized pointer, causing an arbitrary free vulnerability.