diff options
| author | truckman <truckman@FreeBSD.org> | 2016-05-13 06:15:05 +0000 |
|---|---|---|
| committer | truckman <truckman@FreeBSD.org> | 2016-05-13 06:15:05 +0000 |
| commit | 6957aa1da66429cceccf579e2520af25ec66bea1 (patch) | |
| tree | f1b05c53cbabc238619d5a26c337866c3cd74c4e /usr.bin/mail | |
| parent | 7e4340d511e705af9f7804ed8c9f9fe0f7559df8 (diff) | |
| download | FreeBSD-src-6957aa1da66429cceccf579e2520af25ec66bea1.zip FreeBSD-src-6957aa1da66429cceccf579e2520af25ec66bea1.tar.gz | |
Always return either a dynamically allocated string or NULL from
expand(). Never return the name parameter, which could be a the buf[]
buffer which is allocated on the stack by getdeadletter() and which
would then be used after getdeadletter() has returned.
Reported by: Coverity
CID: 1199383
MFC after: 1 week
Diffstat (limited to 'usr.bin/mail')
| -rw-r--r-- | usr.bin/mail/fio.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/usr.bin/mail/fio.c b/usr.bin/mail/fio.c index 1b0efea..d9d4ee1 100644 --- a/usr.bin/mail/fio.c +++ b/usr.bin/mail/fio.c @@ -367,10 +367,10 @@ expand(char *name) name = savestr(xname); } if (!strpbrk(name, "~{[*?$`'\"\\")) - return (name); + return (savestr(name)); if (pipe(pivec) < 0) { warn("pipe"); - return (name); + return (NULL); } (void)snprintf(cmdbuf, sizeof(cmdbuf), "echo %s", name); if ((sh = value("SHELL")) == NULL) |
