Date: Thu, 14 May 2009 23:09:33 +0000 (UTC) From: Xin LI <delphij@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r192129 - head/lib/libc/gen Message-ID: <200905142309.n4EN9XdU005317@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: delphij Date: Thu May 14 23:09:33 2009 New Revision: 192129 URL: http://svn.freebsd.org/changeset/base/192129 Log: As the comment says, close() frees the variable, record. So we obtain the length by evaluating the value from the copy, cbuf instead. This fixes a crash caused by previous commit (use-after-free) Submitted by: Dimitry Andric <dimitry andric com> Pointy hat to: delphij Modified: head/lib/libc/gen/getcap.c Modified: head/lib/libc/gen/getcap.c ============================================================================== --- head/lib/libc/gen/getcap.c Thu May 14 22:36:56 2009 (r192128) +++ head/lib/libc/gen/getcap.c Thu May 14 23:09:33 2009 (r192129) @@ -260,7 +260,7 @@ getent(char **cap, u_int *len, char **db errno = ENOMEM; return (-2); } - *len = strlen(record); + *len = strlen(cbuf); *cap = cbuf; return (retval); } else {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200905142309.n4EN9XdU005317>