[prev in list] [next in list] [prev in thread] [next in thread] 

List:       busybox
Subject:    Re: [PATCH v3] ifconfig: fix double free fatal error in INET_sprint
From:       Zheng Junling <zhengjunling () huawei ! com>
Date:       2015-02-03 11:47:06
Message-ID: 54D0B53A.5060203 () huawei ! com
[Download RAW message or body]

Yeah,

moving free() two lines down is another way to fix this bug.

Thanks!

On 2015/2/3 19:14, Denys Vlasenko wrote:
> On Tue, Feb 3, 2015 at 10:12 AM, Zheng Junling <zhengjunling@huawei.com> wrote:
>> --- a/networking/interface.c
>> +++ b/networking/interface.c
>> @@ -92,6 +92,7 @@ static const char* FAST_FUNC INET_sprint(struct sockaddr *sap, int numeric)
>>         static char *buff; /* defaults to NULL */
>>
>>         free(buff);
>> +       buff = NULL;
>>         if (sap->sa_family == 0xFFFF || sap->sa_family == 0)
>>                 return "[NONE SET]";
>>         buff = INET_rresolve((struct sockaddr_in *) sap, numeric, 0xffffff00);
>> @@ -174,6 +175,7 @@ static const char* FAST_FUNC INET6_sprint(struct sockaddr *sap, int numeric)
>>         static char *buff;
>>
>>         free(buff);
>> +       buff = NULL;
>>         if (sap->sa_family == 0xFFFF || sap->sa_family == 0)
>>                 return "[NONE SET]";
>>         buff = INET6_rresolve((struct sockaddr_in6 *) sap, numeric);
> 
> Thanks for finding it!
> I am going for a different way to fix it: I'll just move free()
> two lines down.
> 
> 


_______________________________________________
busybox mailing list
busybox@busybox.net
http://lists.busybox.net/mailman/listinfo/busybox
[prev in list] [next in list] [prev in thread] [next in thread]