- match_var: do not address memory at invalid address (`len' can be greater

than strlen(var) + 1)
- ReadMakeFile: prevent `fname' memory leak
- ReadMakeFile: prevent double free (caused by double fclose) --
ParsePopInput() closes input file

Reviewed by:	harti

2 files changed, 5 insertions, 3 deletions

diff --git a/usr.bin/make/main.c b/usr.bin/make/main.c
index 4ee3a89..706829c 100644
--- a/usr.bin/make/main.c
+++ b/usr.bin/make/main.c
@@ -298,8 +298,10 @@ ReadMakefile(const char p[])
 		name = Path_FindFile(fname, &parseIncPath);
 		if (!name)
 			name = Path_FindFile(fname, &sysIncPath);
-		if (!name || !(stream = fopen(name, "r")))
+		if (!name || !(stream = fopen(name, "r"))) {
+			free(fname);
 			return (FALSE);
+		}
 		MAKEFILE = fname = name;
 		/*
 		 * set the MAKEFILE variable desired by System V fans -- the
@@ -310,8 +312,8 @@ found:
 		if (setMAKEFILE)
 			Var_SetGlobal("MAKEFILE", MAKEFILE);
 		Parse_File(fname, stream);
-		fclose(stream);
 	}
+	free(fname);
 	return (TRUE);
 }
 
diff --git a/usr.bin/make/var.c b/usr.bin/make/var.c
index 9844e16..ff1bf09 100644
--- a/usr.bin/make/var.c
+++ b/usr.bin/make/var.c
@@ -2246,7 +2246,7 @@ match_var(const char str[], const char var[])
 				   str[0] == CLOSE_BRACE) {
 				len = str - (start + 2);
 
-				if (var[len] == '\0' && strncmp(var, start + 2, len) == 0) {
+				if (strncmp(var, start + 2, len) == 0 && var[len] == '\0') {
 					return (0);	/* match */
 				} else {
 					/*