diff options
| author | Omar Polo <op@cvs.openbsd.org> | 2023-03-22 19:42:42 +0000 |
|---|---|---|
| committer | Omar Polo <op@cvs.openbsd.org> | 2023-03-22 19:42:42 +0000 |
| commit | 1bfa8890253b5984c35cbfb8d4b78e8bce4d468c (patch) | |
| tree | abd3c4eb83dbd855f8ff91ba185c165017e6b8fe /usr.bin/mg | |
| parent | cd04920052138ba80299c994d3a406cb1ed9548c (diff) | |
avoid memleak / crash in addctag
the l pointer is advanced, so if the line is malformed `goto cleanup'
will free(NULL) or a pointer inside l.
semplification and ok tb@
Diffstat (limited to 'usr.bin/mg')
| -rw-r--r-- | usr.bin/mg/tags.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/usr.bin/mg/tags.c b/usr.bin/mg/tags.c index 44311120ae8..cd87ee556e7 100644 --- a/usr.bin/mg/tags.c +++ b/usr.bin/mg/tags.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tags.c,v 1.21 2023/03/22 18:18:35 op Exp $ */ +/* $OpenBSD: tags.c,v 1.22 2023/03/22 19:42:41 op Exp $ */ /* * This file is in the public domain. @@ -367,17 +367,18 @@ strip(char *s, size_t len) * l, and can be freed during cleanup. */ int -addctag(char *l) +addctag(char *s) { struct ctag *t = NULL; + char *l; if ((t = malloc(sizeof(struct ctag))) == NULL) { dobeep(); ewprintf("Out of memory"); goto cleanup; } - t->tag = l; - if ((l = strchr(l, '\t')) == NULL) + t->tag = s; + if ((l = strchr(s, '\t')) == NULL) goto cleanup; *l++ = '\0'; t->fname = l; @@ -391,7 +392,7 @@ addctag(char *l) return (TRUE); cleanup: free(t); - free(l); + free(s); return (FALSE); } |