Zsh Mailing List Archive
Messages sorted by: Reverse Date, Date, Thread, Author

PATCH: use after free in setstrvalue



I don't really know what's going on here, but it's probably safer to
free val after possibly passing it to strlen().

Index: Src/params.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/params.c,v
retrieving revision 1.145
diff -u -r1.145 params.c
--- Src/params.c	5 Sep 2008 21:02:15 -0000	1.145
+++ Src/params.c	13 Sep 2008 08:13:26 -0000
@@ -2235,10 +2235,10 @@
     case PM_INTEGER:
 	if (val) {
 	    v->pm->gsu.i->setfn(v->pm, mathevali(val));
-	    zsfree(val);
 	    if ((v->pm->node.flags & (PM_LEFT | PM_RIGHT_B | PM_RIGHT_Z)) &&
 		!v->pm->width)
 		v->pm->width = strlen(val);
+	    zsfree(val);
 	}
 	if (!v->pm->base && lastbase != -1)
 	    v->pm->base = lastbase;



Messages sorted by: Reverse Date, Date, Thread, Author