diff options
| author | Owain Ainsworth <oga@cvs.openbsd.org> | 2008-04-08 17:38:28 +0000 |
|---|---|---|
| committer | Owain Ainsworth <oga@cvs.openbsd.org> | 2008-04-08 17:38:28 +0000 |
| commit | c50bcebc3126035aac42fcef88935f7f77d7e37a (patch) | |
| tree | 9ac99792d5d1309ea470778b4ee9c37c7acf5f24 | |
| parent | 3899864548d2349157c8fc623ee783b6a4ce009a (diff) | |
No cookie for okan.
fix use-after-free that broke exec's path getting stuff.
``paths'' isn't used anymore, but pointers to within that array are still
used in the next loop. delay freeing it until after then.
| -rw-r--r-- | app/cwm/kbfunc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/app/cwm/kbfunc.c b/app/cwm/kbfunc.c index 124a85af5..954f7039a 100644 --- a/app/cwm/kbfunc.c +++ b/app/cwm/kbfunc.c @@ -15,7 +15,7 @@ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. * - * $Id: kbfunc.c,v 1.18 2008/04/07 23:47:09 simon Exp $ + * $Id: kbfunc.c,v 1.19 2008/04/08 17:38:27 oga Exp $ */ #include <paths.h> @@ -307,7 +307,6 @@ kbfunc_exec(struct client_ctx *scratch, void *arg) ap++; } *ap = NULL; - xfree(path); for (i = 0; i < NPATHS && paths[i] != NULL; i++) { if ((dirp = opendir(paths[i])) == NULL) continue; @@ -351,6 +350,7 @@ kbfunc_exec(struct client_ctx *scratch, void *arg) } (void) closedir(dirp); } + xfree(path); if ((mi = search_start(&menuq, search_match_exec, NULL, label, 1)) != NULL) { |