d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MFC r300624:

Browse Source 
Fix up r300385

I accidentally glossed over the fact that tmp is manipulated via strchr, so
if we tried to free `tmp` after r300385, it would have crashed.

Create a separate pointer (tmp2) to track the original allocation of `tmp`,
and free `tmp2` if `p->nc_lookups` can't be malloced

CID: 1356026
This commit is contained in:
ngie 2016-06-08 18:46:10 +00:00
parent 19b157a811
commit bbefcf038b
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/libc/rpc/getnetconfig.c
View File

@ -697,7 +697,7 @@ dup_ncp(ncp)
struct netconfig *ncp;
{
struct netconfig *p;
char *tmp;
char *tmp, *tmp2;
u_int i;
if ((tmp=malloc(MAXNETCONFIGLINE)) == NULL)
@ -706,6 +706,7 @@ struct netconfig *ncp;
free(tmp);
return(NULL);
}
tmp2 = tmp;
/*
* First we dup all the data from matched netconfig buffer. Then we
* adjust some of the member pointer to a pre-allocated buffer where
@ -727,7 +728,7 @@ struct netconfig *ncp;
if (p->nc_lookups == NULL) {
free(p->nc_netid);
free(p);
free(tmp);
free(tmp2);
return(NULL);
}
for (i=0; i < p->nc_nlookups; i++) {