Bad free in lib/libc/gen/glob.c

Article View: comp.bugs.4bsd

Article #397

#397

From: Richard Ohnemus
Date: Thu, 27 Jun 1991 15:30

28 lines
1305 bytes

This is a patch to glob.c from uunet ~/bsd-sources/lib/libc/gen/glob.c

The function globfree tries to free an invalid pointer instead of the
array of path pointers.

*** glob.c.old	Thu Jun 27 10:28:28 1991
--- glob.c	Thu Jun 27 10:22:16 1991
***************
*** 413,418 ****
  		for (i = pglob->gl_pathc; i--; ++pp)
  			if (*pp)
  				(void)free(*pp);
! 		(void)free((char *)pp);
  	}
  }
--- 413,418 ----
  		for (i = pglob->gl_pathc; i--; ++pp)
  			if (*pp)
  				(void)free(*pp);
! 		(void)free((char *)pglob->gl_pathv);
  	}
  }
-- 
Rick Ohnemus   INTERNET: rick@sparky.IMD.Sterling.COM   UUCP: uunet!sparky!rick
LAND: Sterling Software IMD, 1404 Ft. Crook Rd. South, Bellevue NE. 68005-2969
Phone: (402) 291-8300        FAX: (402) 291-4362
I never receive credit for anything I write! (I'm an Ohnemus. 8-)

Technical Details

Message-ID: <1991Jun27.153030.21063@sparky.IMD.Sterling.COM>

Path:

arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!elroy.jpl.nasa.gov!usc!samsung!spool.mu.edu!olivea!uunet!sparky!rick

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!elroy.jpl.nasa.gov!usc!samsung!spool.mu.edu!olivea!uunet!sparky!rick
From: rick@sparky.IMD.Sterling.COM (Richard Ohnemus)
Newsgroups: comp.bugs.4bsd
Subject: Bad free in lib/libc/gen/glob.c
Message-ID: <1991Jun27.153030.21063@sparky.IMD.Sterling.COM>
Date: 27 Jun 91 15:30:30 GMT
Sender: rick@sparky.IMD.Sterling.COM (Richard Ohnemus)
Organization: Sterling Software, IMD
Lines: 28