Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 8 Jun 2016 18:47:00 +0000 (UTC)
From:      Garrett Cooper <ngie@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org
Subject:   svn commit: r301688 - stable/9/lib/libc/rpc
Message-ID:  <201606081847.u58Il02l061329@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: ngie
Date: Wed Jun  8 18:47:00 2016
New Revision: 301688
URL: https://svnweb.freebsd.org/changeset/base/301688

Log:
  MFstable/10 r301687:
  
  MFC r300624:
  
  Fix up r300385
  
  I accidentally glossed over the fact that tmp is manipulated via strchr, so
  if we tried to free `tmp` after r300385, it would have crashed.
  
  Create a separate pointer (tmp2) to track the original allocation of `tmp`,
  and free `tmp2` if `p->nc_lookups` can't be malloced
  
  CID: 1356026

Modified:
  stable/9/lib/libc/rpc/getnetconfig.c
Directory Properties:
  stable/9/   (props changed)
  stable/9/lib/   (props changed)
  stable/9/lib/libc/   (props changed)

Modified: stable/9/lib/libc/rpc/getnetconfig.c
==============================================================================
--- stable/9/lib/libc/rpc/getnetconfig.c	Wed Jun  8 18:46:10 2016	(r301687)
+++ stable/9/lib/libc/rpc/getnetconfig.c	Wed Jun  8 18:47:00 2016	(r301688)
@@ -697,7 +697,7 @@ dup_ncp(ncp)
 struct netconfig	*ncp;
 {
     struct netconfig	*p;
-    char	*tmp;
+    char	*tmp, *tmp2;
     u_int	i;
 
     if ((tmp=malloc(MAXNETCONFIGLINE)) == NULL)
@@ -706,6 +706,7 @@ struct netconfig	*ncp;
 	free(tmp);
 	return(NULL);
     }
+    tmp2 = tmp;
     /*
      * First we dup all the data from matched netconfig buffer.  Then we
      * adjust some of the member pointer to a pre-allocated buffer where
@@ -727,7 +728,7 @@ struct netconfig	*ncp;
     if (p->nc_lookups == NULL) {
 	free(p->nc_netid);
 	free(p);
-	free(tmp);
+	free(tmp2);
 	return(NULL);
     }
     for (i=0; i < p->nc_nlookups; i++) {



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201606081847.u58Il02l061329>