diff options
| author | Sebastien Marie <semarie@cvs.openbsd.org> | 2015-08-24 06:19:40 +0000 |
|---|---|---|
| committer | Sebastien Marie <semarie@cvs.openbsd.org> | 2015-08-24 06:19:40 +0000 |
| commit | a0f40112b4aa873c64555c2e71250a82a8cf1589 (patch) | |
| tree | b86f27e156b1f84eafa2e070edfb0e9637351def | |
| parent | ef6360b9bf5352d54e5e8adc3dd2b4a3c52b6eeb (diff) | |
corrects two potential double-free on `cwdpath'. The variable will be free'ed
outside the for-loop.
OK deraadt@
| -rw-r--r-- | sys/kern/kern_tame.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/sys/kern/kern_tame.c b/sys/kern/kern_tame.c index c453ac3efdb..50f97614ff1 100644 --- a/sys/kern/kern_tame.c +++ b/sys/kern/kern_tame.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kern_tame.c,v 1.27 2015/08/24 06:17:48 doug Exp $ */ +/* $OpenBSD: kern_tame.c,v 1.28 2015/08/24 06:19:39 semarie Exp $ */ /* * Copyright (c) 2015 Nicholas Marriott <nicm@openbsd.org> @@ -282,7 +282,6 @@ sys_tame(struct proc *p, void *v, register_t *retval) NULL, &bp, cwdpath, cwdpathlen/2, GETCWD_CHECK_ACCESS, p); if (error) { - free(cwdpath, M_TEMP, cwdpathlen); printf("getcwd: %d\n", error); break; } @@ -293,7 +292,6 @@ sys_tame(struct proc *p, void *v, register_t *retval) /* NUL included in cwd component */ builtlen = cwdlen + 1 + strlen(path); if (builtlen > PATH_MAX) { - free(cwdpath, M_TEMP, cwdpathlen); error = ENAMETOOLONG; break; } |