Nasty annoying memory overflow in argcv_get() that was causing random
crashes. Couple of places check if (ptr == NULL) before free(), this is not a bug since POSIX requires free(NULL) to be legal but on some old station like SunOS-4 that will corrupt the freelist or crash. Some Copyright updates.
Showing
4 changed files
with
12 additions
and
7 deletions
... | @@ -41,17 +41,17 @@ argcv_get (const char *command, int *argc, char ***argv) | ... | @@ -41,17 +41,17 @@ argcv_get (const char *command, int *argc, char ***argv) |
41 | if (command[i] == ' ') | 41 | if (command[i] == ' ') |
42 | (*argc)++; | 42 | (*argc)++; |
43 | 43 | ||
44 | *argv = malloc ((*argc + 1) * sizeof (char *)); | 44 | *argv = calloc ((*argc + 1), sizeof (char *)); |
45 | 45 | ||
46 | for (i = 0; i <= len; i++) | 46 | for (i = 0; i <= len; i++) |
47 | { | 47 | { |
48 | if (command[i] == ' ' || command[i] == '\0') | 48 | if (command[i] == ' ' || command[i] == '\0') |
49 | { | 49 | { |
50 | (*argv)[j] = malloc ((i-start) * sizeof (char)); | 50 | /* Reserve space for the null. */ |
51 | if (argv[j] == NULL && (i-start > 0)) | 51 | (*argv)[j] = calloc ((i - start + 1), sizeof (char)); |
52 | if ((*argv[j]) == NULL) | ||
52 | return 1; | 53 | return 1; |
53 | strncpy ((*argv)[j], &command[start], i-start); | 54 | strncpy ((*argv)[j], &command[start], i - start); |
54 | (*argv)[j][i-start] = '\0'; | ||
55 | j++; | 55 | j++; |
56 | start = i+1; | 56 | start = i+1; |
57 | } | 57 | } |
... | @@ -68,6 +68,7 @@ int | ... | @@ -68,6 +68,7 @@ int |
68 | argcv_free (int argc, char **argv) | 68 | argcv_free (int argc, char **argv) |
69 | { | 69 | { |
70 | while (--argc >= 0) | 70 | while (--argc >= 0) |
71 | if (argv[argc]) | ||
71 | free (argv[argc]); | 72 | free (argv[argc]); |
72 | free (argv); | 73 | free (argv); |
73 | return 1; | 74 | return 1; | ... | ... |
1 | /* GNU mailutils - a suite of utilities for electronic mail | 1 | /* GNU mailutils - a suite of utilities for electronic mail |
2 | Copyright (C) 1999, 2000 Free Software Foundation, Inc. | 2 | Copyright (C) 1999, 2000, 2001 Free Software Foundation, Inc. |
3 | 3 | ||
4 | This program is free software; you can redistribute it and/or modify | 4 | This program is free software; you can redistribute it and/or modify |
5 | it under the terms of the GNU General Public License as published by | 5 | it under the terms of the GNU General Public License as published by | ... | ... |
... | @@ -249,6 +249,7 @@ main (int argc, char **argv) | ... | @@ -249,6 +249,7 @@ main (int argc, char **argv) |
249 | while (1) | 249 | while (1) |
250 | { | 250 | { |
251 | int len; | 251 | int len; |
252 | if (command) | ||
252 | free (command); | 253 | free (command); |
253 | command = readline (prompt->set && prompt->value != NULL ? prompt->value : " "); | 254 | command = readline (prompt->set && prompt->value != NULL ? prompt->value : " "); |
254 | len = strlen (command); | 255 | len = strlen (command); | ... | ... |
1 | /* GNU mailutils - a suite of utilities for electronic mail | 1 | /* GNU mailutils - a suite of utilities for electronic mail |
2 | Copyright (C) 1999 Free Software Foundation, Inc. | 2 | Copyright (C) 1999, 2001 Free Software Foundation, Inc. |
3 | 3 | ||
4 | This program is free software; you can redistribute it and/or modify | 4 | This program is free software; you can redistribute it and/or modify |
5 | it under the terms of the GNU General Public License as published by | 5 | it under the terms of the GNU General Public License as published by |
... | @@ -45,6 +45,7 @@ mail_set (int argc, char **argv) | ... | @@ -45,6 +45,7 @@ mail_set (int argc, char **argv) |
45 | if (entry == NULL) | 45 | if (entry == NULL) |
46 | return 1; | 46 | return 1; |
47 | entry->set = 0; | 47 | entry->set = 0; |
48 | if (entry->value) | ||
48 | free (entry->value); | 49 | free (entry->value); |
49 | } | 50 | } |
50 | else if (strchr (argv[i], '=') != NULL) | 51 | else if (strchr (argv[i], '=') != NULL) |
... | @@ -63,6 +64,7 @@ mail_set (int argc, char **argv) | ... | @@ -63,6 +64,7 @@ mail_set (int argc, char **argv) |
63 | if (entry == NULL) | 64 | if (entry == NULL) |
64 | return 1; | 65 | return 1; |
65 | entry->set = 1; | 66 | entry->set = 1; |
67 | if (entry->value) | ||
66 | free (entry->value); | 68 | free (entry->value); |
67 | entry->value = value; | 69 | entry->value = value; |
68 | } | 70 | } |
... | @@ -72,6 +74,7 @@ mail_set (int argc, char **argv) | ... | @@ -72,6 +74,7 @@ mail_set (int argc, char **argv) |
72 | if (entry == NULL) | 74 | if (entry == NULL) |
73 | return 1; | 75 | return 1; |
74 | entry->set = 1; | 76 | entry->set = 1; |
77 | if (entry->value) | ||
75 | free (entry->value); | 78 | free (entry->value); |
76 | entry->value = NULL; | 79 | entry->value = NULL; |
77 | } | 80 | } | ... | ... |
-
Please register or sign in to post a comment