diff options
| author | ngie <ngie@FreeBSD.org> | 2016-05-24 19:52:05 +0000 |
|---|---|---|
| committer | ngie <ngie@FreeBSD.org> | 2016-05-24 19:52:05 +0000 |
| commit | 58d3da23e28667e0a896094120e4b295f20dfdab (patch) | |
| tree | 88e88a633dc4afd23560def12501c88f181b5916 /lib/libc | |
| parent | 53adc2c3cd2597a7eac8249c9ac469bbc35c1bed (diff) | |
| download | FreeBSD-src-58d3da23e28667e0a896094120e4b295f20dfdab.zip FreeBSD-src-58d3da23e28667e0a896094120e4b295f20dfdab.tar.gz | |
Fix up r300385
I accidentally glossed over the fact that tmp is manipulated via strchr, so
if we tried to free `tmp` after r300385, it would have crashed.
Create a separate pointer (tmp2) to track the original allocation of `tmp`,
and free `tmp2` if `p->nc_lookups` can't be malloced
MFC after: 4 days
X-MFC with: r300385
Reported by: Coverity
CID: 1356026
Sponsored by: EMC / Isilon Storage Division
Diffstat (limited to 'lib/libc')
| -rw-r--r-- | lib/libc/rpc/getnetconfig.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/lib/libc/rpc/getnetconfig.c b/lib/libc/rpc/getnetconfig.c index 2ba2b7c..6d504c5 100644 --- a/lib/libc/rpc/getnetconfig.c +++ b/lib/libc/rpc/getnetconfig.c @@ -692,7 +692,7 @@ static struct netconfig * dup_ncp(struct netconfig *ncp) { struct netconfig *p; - char *tmp; + char *tmp, *tmp2; u_int i; if ((tmp=malloc(MAXNETCONFIGLINE)) == NULL) @@ -701,6 +701,7 @@ dup_ncp(struct netconfig *ncp) free(tmp); return(NULL); } + tmp2 = tmp; /* * First we dup all the data from matched netconfig buffer. Then we * adjust some of the member pointer to a pre-allocated buffer where @@ -722,7 +723,7 @@ dup_ncp(struct netconfig *ncp) if (p->nc_lookups == NULL) { free(p->nc_netid); free(p); - free(tmp); + free(tmp2); return(NULL); } for (i=0; i < p->nc_nlookups; i++) { |
