diff options
| author | Bruno Haible <bruno@clisp.org> | 2019-06-10 16:50:04 +0200 |
|---|---|---|
| committer | Bruno Haible <bruno@clisp.org> | 2019-06-10 17:24:58 +0200 |
| commit | 765146c33361b46aa2c592e980b16069094c6000 (patch) | |
| tree | b8cbb15b10cca39202340848c26b980ef838b068 /lib/spawn_faction_destroy.c | |
| parent | fbb40ec10e333cff0b9845572065edd9e66eac79 (diff) | |
| download | gnulib-765146c33361b46aa2c592e980b16069094c6000.tar.gz | |
posix_spawn_file_actions_addopen: Fix possible use-after-free bug.
Reported at <https://sourceware.org/bugzilla/show_bug.cgi?id=17048>.
* lib/spawn_int.h (struct __spawn_action): Remove 'const' from path.
* lib/spawn_faction_addopen.c (posix_spawn_file_actions_addopen): Make
a copy of the path argument.
* lib/spawn_faction_destroy.c (posix_spawn_file_actions_destroy): Free
it.
Diffstat (limited to 'lib/spawn_faction_destroy.c')
| -rw-r--r-- | lib/spawn_faction_destroy.c | 29 |
1 files changed, 28 insertions, 1 deletions
diff --git a/lib/spawn_faction_destroy.c b/lib/spawn_faction_destroy.c index 6d9ec800f2..0640da483f 100644 --- a/lib/spawn_faction_destroy.c +++ b/lib/spawn_faction_destroy.c @@ -21,11 +21,38 @@ #include <stdlib.h> +#if REPLACE_POSIX_SPAWN +# include "spawn_int.h" +#endif + /* Initialize data structure for file attribute for 'spawn' call. */ int posix_spawn_file_actions_destroy (posix_spawn_file_actions_t *file_actions) +#undef posix_spawn_file_actions_destroy { - /* Free the memory allocated. */ +#if !REPLACE_POSIX_SPAWN + return posix_spawn_file_actions_destroy (file_actions); +#else + int i; + + /* Free the paths in the open actions. */ + for (i = 0; i < file_actions->_used; ++i) + { + struct __spawn_action *sa = &file_actions->_actions[i]; + switch (sa->tag) + { + case spawn_do_open: + free (sa->action.open_action.path); + break; + default: + /* No cleanup required. */ + break; + } + } + + /* Free the array of actions. */ free (file_actions->_actions); + return 0; +#endif } |