diff options
author | ngie <ngie@FreeBSD.org> | 2016-06-08 18:46:10 +0000 |
---|---|---|
committer | ngie <ngie@FreeBSD.org> | 2016-06-08 18:46:10 +0000 |
commit | bbefcf038b874f2f51eaf614c49ae35662713d02 (patch) | |
tree | af654e24f8f89c3bff1339cf985d732442efe28f /lib | |
parent | 19b157a8116da2945866da58f7a3b88ec05beb27 (diff) | |
download | FreeBSD-src-bbefcf038b874f2f51eaf614c49ae35662713d02.zip FreeBSD-src-bbefcf038b874f2f51eaf614c49ae35662713d02.tar.gz |
MFC r300624:
Fix up r300385
I accidentally glossed over the fact that tmp is manipulated via strchr, so
if we tried to free `tmp` after r300385, it would have crashed.
Create a separate pointer (tmp2) to track the original allocation of `tmp`,
and free `tmp2` if `p->nc_lookups` can't be malloced
CID: 1356026
Diffstat (limited to 'lib')
-rw-r--r-- | lib/libc/rpc/getnetconfig.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/lib/libc/rpc/getnetconfig.c b/lib/libc/rpc/getnetconfig.c index 255e3bd..9220b1c 100644 --- a/lib/libc/rpc/getnetconfig.c +++ b/lib/libc/rpc/getnetconfig.c @@ -697,7 +697,7 @@ dup_ncp(ncp) struct netconfig *ncp; { struct netconfig *p; - char *tmp; + char *tmp, *tmp2; u_int i; if ((tmp=malloc(MAXNETCONFIGLINE)) == NULL) @@ -706,6 +706,7 @@ struct netconfig *ncp; free(tmp); return(NULL); } + tmp2 = tmp; /* * First we dup all the data from matched netconfig buffer. Then we * adjust some of the member pointer to a pre-allocated buffer where @@ -727,7 +728,7 @@ struct netconfig *ncp; if (p->nc_lookups == NULL) { free(p->nc_netid); free(p); - free(tmp); + free(tmp2); return(NULL); } for (i=0; i < p->nc_nlookups; i++) { |