From 26b21882bfd8a3712614e94dde41a5194dda7aee Mon Sep 17 00:00:00 2001 From: Ashwini Sharma Date: Fri, 2 May 2014 06:24:11 -0500 Subject: In function readfile(), the buffer buf is free'd when readall() fails. This free can cause a crash, if the buffer passed by user of function is not malloc'ed one. names_to_pid() is one usecase example here. --- lib/lib.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'lib/lib.c') diff --git a/lib/lib.c b/lib/lib.c index c1029d20..670f6a71 100644 --- a/lib/lib.c +++ b/lib/lib.c @@ -323,9 +323,10 @@ off_t fdlength(int fd) // Read contents of file as a single nul-terminated string. // malloc new one if buf=len=0 -char *readfile(char *name, char *buf, off_t len) +char *readfile(char *name, char *ibuf, off_t len) { int fd; + char *buf; fd = open(name, O_RDONLY); if (fd == -1) return 0; @@ -335,12 +336,13 @@ char *readfile(char *name, char *buf, off_t len) // proc files don't report a length, so try 1 page minimum. if (len<4096) len = 4096; } - if (!buf) buf = xmalloc(len+1); + if (!ibuf) buf = xmalloc(len+1); + else buf = ibuf; len = readall(fd, buf, len-1); close(fd); if (len<0) { - free(buf); + if (ibuf != buf) free(buf); buf = 0; } else buf[len] = 0; -- cgit v1.2.3