diff options
author | brucec <brucec@FreeBSD.org> | 2010-11-21 14:34:25 +0000 |
---|---|---|
committer | brucec <brucec@FreeBSD.org> | 2010-11-21 14:34:25 +0000 |
commit | bf8d02a8b8c7adcf02b43fc301279d3f0de89ea1 (patch) | |
tree | 0645cf8bd4be1ae382c48f88a40b20d33ffd93b6 | |
parent | 63a10f10ab5a74e40ad28c3f8de32e75b390c48f (diff) | |
download | FreeBSD-src-bf8d02a8b8c7adcf02b43fc301279d3f0de89ea1.zip FreeBSD-src-bf8d02a8b8c7adcf02b43fc301279d3f0de89ea1.tar.gz |
dispatch_add_command:
Modify the logic so there's only one exit point instead of two.
Only insert valid (non-NULL) values into the queue.
dispatch_free_command:
Ensure that item is not NULL before removing it from the queue and
dereferencing the pointer.
NULL out free'd pointers to catch any use-after-free bugs.
PR: bin/146855
Submitted by: gcooper
MFC after: 3 days
-rw-r--r-- | usr.sbin/sysinstall/dispatch.c | 32 |
1 files changed, 23 insertions, 9 deletions
diff --git a/usr.sbin/sysinstall/dispatch.c b/usr.sbin/sysinstall/dispatch.c index 0e4a634..44aa0fa 100644 --- a/usr.sbin/sysinstall/dispatch.c +++ b/usr.sbin/sysinstall/dispatch.c @@ -136,8 +136,12 @@ typedef struct command_buffer_ { static void dispatch_free_command(command_buffer *item) { - REMQUE(item); - free(item->string); + if (item != NULL) { + REMQUE(item); + free(item->string); + item->string = NULL; + } + free(item); } @@ -155,19 +159,29 @@ dispatch_free_all(qelement *head) static command_buffer * dispatch_add_command(qelement *head, char *string) { - command_buffer *new; + command_buffer *new = NULL; new = malloc(sizeof(command_buffer)); - if (!new) - return NULL; + if (new != NULL) { - new->string = strdup(string); - INSQUEUE(new, head->q_back); + new->string = strdup(string); + + /* + * We failed to copy `string'; clean up the allocated + * resources. + */ + if (new->string == NULL) { + free(new); + new = NULL; + } else { + INSQUEUE(new, head->q_back); + } + } return new; } - + /* * Command processing */ @@ -280,7 +294,7 @@ dispatchCommand(char *str) return i; } - + /* * File processing */ |