Mark Lord writes:

The config file processing for inetd in busybox-1.00-pre7 and newer
is broken -- the saved command argv[] values overwrite each other.

Patch to fix it is attached.

Cheers
--
Mark Lord
Real-Time Remedies Inc.


git-svn-id: svn://busybox.net/trunk/busybox@8502 69ca8d6d-28ef-0310-b511-8ec308f3f277

1 files changed, 5 insertions, 2 deletions

diff --git a/networking/inetd.c b/networking/inetd.c
index eb61299c2..2906b3c0a 100644
--- a/networking/inetd.c
+++ b/networking/inetd.c
@@ -426,7 +426,7 @@ more:
                 sep->se_argv[argc++] = NULL;
         }
 
-        free(cp);
+        //free(cp);     // BUG: cp is the argv[] container; we must not free it here!
         return (sep);
 }
 
@@ -589,7 +589,10 @@ static void config(int signum)
                                 SWAP(char *, sep->se_argv[i], cp->se_argv[i]);
 #undef SWAP
                         sigprocmask(SIG_SETMASK, &oldmask, NULL);
-                        freeconfig(cp);
+                        // This freeconfig() is probably a bug, since it will try and free()
+                        // each of the argv[] values, which are really just pointers
+                        // into the middle of a single line buffer for the config file.
+                        //freeconfig(cp);       // BUG?
                 } else {
                         sep = (struct servtab *)xmalloc(sizeof (*sep));
                         *sep = *cp;