Re: PATCH: use after free in setstrvalue

[Clint Adams <clint@xxxxxxx>]

On Sat, Sep 13, 2008 at 08:16:28AM +0000, Clint Adams wrote:
> -	    zsfree(val);
>  	    if ((v->pm->node.flags & (PM_LEFT | PM_RIGHT_B | PM_RIGHT_Z)) &&
>  		!v->pm->width)
>  		v->pm->width = strlen(val);
> +	    zsfree(val);

Should have done this one too..

Index: Src/params.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/params.c,v
retrieving revision 1.149
diff -u -r1.149 params.c
--- Src/params.c	9 Oct 2008 13:46:45 -0000	1.149
+++ Src/params.c	23 Oct 2008 00:45:00 -0000
@@ -2253,10 +2253,10 @@
 	    mnumber mn = matheval(val);
 	    v->pm->gsu.f->setfn(v->pm, (mn.type & MN_FLOAT) ? mn.u.d :
 			       (double)mn.u.l);
-	    zsfree(val);
 	    if ((v->pm->node.flags & (PM_LEFT | PM_RIGHT_B | PM_RIGHT_Z)) &&
 		!v->pm->width)
 		v->pm->width = strlen(val);
+	    zsfree(val);
 	}
 	break;
     case PM_ARRAY: