diff options
| author | Denys Vlasenko <vda.linux@googlemail.com> | 2023-01-02 17:05:55 +0100 |
|---|---|---|
| committer | Denys Vlasenko <vda.linux@googlemail.com> | 2023-01-02 17:05:55 +0100 |
| commit | 9b2d766e0ecb222d25a43333287835452e43f8a9 (patch) | |
| tree | 6750470dd6f12037765011745d0bc3efb9f1fc72 /editors/sed.c | |
| parent | cadf57b3afac5f77c75516d82aed4bc845b5d704 (diff) | |
| download | busybox-w32-9b2d766e0ecb222d25a43333287835452e43f8a9.tar.gz busybox-w32-9b2d766e0ecb222d25a43333287835452e43f8a9.tar.bz2 busybox-w32-9b2d766e0ecb222d25a43333287835452e43f8a9.zip | |
sed: fix double-free in FEATURE_CLEAN_UP=y configs
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat (limited to '')
| -rw-r--r-- | editors/sed.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/editors/sed.c b/editors/sed.c index 32a4b61f6..00dde60be 100644 --- a/editors/sed.c +++ b/editors/sed.c | |||
| @@ -99,7 +99,7 @@ enum { | |||
| 99 | 99 | ||
| 100 | struct sed_FILE { | 100 | struct sed_FILE { |
| 101 | struct sed_FILE *next; /* Next (linked list, NULL terminated) */ | 101 | struct sed_FILE *next; /* Next (linked list, NULL terminated) */ |
| 102 | const char *fname; | 102 | char *fname; |
| 103 | FILE *fp; | 103 | FILE *fp; |
| 104 | }; | 104 | }; |
| 105 | 105 | ||
| @@ -188,9 +188,6 @@ static void sed_free_and_close_stuff(void) | |||
| 188 | while (sed_cmd) { | 188 | while (sed_cmd) { |
| 189 | sed_cmd_t *sed_cmd_next = sed_cmd->next; | 189 | sed_cmd_t *sed_cmd_next = sed_cmd->next; |
| 190 | 190 | ||
| 191 | if (sed_cmd->sw_file) | ||
| 192 | fclose(sed_cmd->sw_file); | ||
| 193 | |||
| 194 | /* Used to free regexps, but now there is code | 191 | /* Used to free regexps, but now there is code |
| 195 | * in get_address() which can reuse a regexp | 192 | * in get_address() which can reuse a regexp |
| 196 | * for constructs as /regexp/cmd1;//cmd2 | 193 | * for constructs as /regexp/cmd1;//cmd2 |
| @@ -217,6 +214,18 @@ static void sed_free_and_close_stuff(void) | |||
| 217 | 214 | ||
| 218 | if (G.current_fp) | 215 | if (G.current_fp) |
| 219 | fclose(G.current_fp); | 216 | fclose(G.current_fp); |
| 217 | |||
| 218 | if (G.FILE_head) { | ||
| 219 | struct sed_FILE *cur = G.FILE_head; | ||
| 220 | do { | ||
| 221 | struct sed_FILE *p; | ||
| 222 | fclose(cur->fp); | ||
| 223 | free(cur->fname); | ||
| 224 | p = cur; | ||
| 225 | cur = cur->next; | ||
| 226 | free(p); | ||
| 227 | } while (cur); | ||
| 228 | } | ||
| 220 | } | 229 | } |
| 221 | #else | 230 | #else |
| 222 | void sed_free_and_close_stuff(void); | 231 | void sed_free_and_close_stuff(void); |