Skip to contentSkip to conversation

sxpr dereferences freed memory

PATCH New Charles Coffing 1 participant 1 message Nov 22, 2004

lore
Share & tools
lore

Charles Coffing

author
#0 lore raw

PATCH 1/1 sxpr dereferences freed memory

The attached patch applies to 2.0-testing.

If the xfrd daemon receives a message that is immediately followed by an EOF, without first seeing whitespace (usually a newline), the sxpr parser will dereference freed memory. The attached patch fixes the dangling pointer.

Thanks,
Charles

===== tools/xfrd/sxpr_parser.c 1.1 vs edited =====

tools/xfrd/sxpr_parser.c +3 -1
@@ -242,6 +242,8 @@
     int err = 0;
     ParserState *s = p->state;
     p->state = s->parent;
+    if (p->start_state == s)
+        p->start_state = NULL;
     ParserState_free(s);
     return err;
 }

@@ -374,7 +376,7 @@
     if(CONSP(p->val)){
         v = p->val;
         p->val = ONONE;
-    } else if(CONSP(p->start_state->val)){
+    } else if(p->start_state && CONSP(p->start_state->val)){
         v = p->start_state->val;
         p->start_state->val = ONULL;
         v = nrev(v);