Carl Shapiro pushed to branch master at cmucl / cmucl
Commits: 729fae26 by Carl Shapiro at 2024-04-25T01:15:17-07:00 Fix a double free detected by the GCC analyzer
The obuffer variable contained a pointer to a block of memory freed by realloc(3) if the ERANGE case was executed more than once. Afterward, if the 0 case executed, obuffer would be passed to free(3) causing a double free.
This change sets the value of obuffer to buffer immediately after a successful call to realloc(3) ensure it is always NULL or a valid block of memory.
- - - - - 7c91087e by Carl Shapiro at 2024-04-25T16:37:26+00:00 Merge branch 'file-author' into 'master'
Fix a double free detected by the GCC analyzer
See merge request cmucl/cmucl!210 - - - - -
1 changed file:
- src/lisp/os-common.c
Changes:
===================================== src/lisp/os-common.c ===================================== @@ -762,10 +762,10 @@ os_file_author(const char *path) case ERANGE: /* Buffer is too small, double its size and try again */ size *= 2; - obuffer = (buffer == initial) ? NULL : buffer; if ((buffer = realloc(obuffer, size)) == NULL) { goto exit; } + obuffer = buffer; continue; default: /* All other errors */
View it on GitLab: https://gitlab.common-lisp.net/cmucl/cmucl/-/compare/8de3c927c724813022110b6...