Summary
The buffer copy is freed twice, leading to possible memory corruption or vulnerability.
Cause
In split(), at shpsort.c:107, the buffer copy is free'd. realloc() fails on line 110, the buffer copy is freed again at shpsort.c:116.
Impact
A double-free bug can lead to an attacker gaining control over the values returned from malloc(), which in turn may allow both disclosure of sensitive data (e.g. bypassing additional safety features) or in the worst case hostile code execution.
Vulnerable version
Proposed mitigation
Remove line 116, as it is redundant.
Summary
The buffer
copyis freed twice, leading to possible memory corruption or vulnerability.Cause
In
split(), at shpsort.c:107, the buffercopyis free'd.realloc()fails on line 110, the buffercopyis freed again at shpsort.c:116.Impact
A double-free bug can lead to an attacker gaining control over the values returned from
malloc(), which in turn may allow both disclosure of sensitive data (e.g. bypassing additional safety features) or in the worst case hostile code execution.Vulnerable version
Proposed mitigation
Remove line 116, as it is redundant.