Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevents unintended free in finish_merged_header when n_targets == 0 #498

Closed
wants to merge 1 commit into from

Conversation

daviesrob
Copy link
Member

finish_merged_header reallocs the target_name and target_len arrays to
be exactly n_targets in size. This caused a problem when n_targets == 0
as realloc(ptr, 0) frees ptr. To stop this from happening, make sure we
always allocate at least one element.

Fixes #495

finish_merged_header reallocs the target_name and target_len arrays to
be exactly n_targets in size.  This caused a problem when n_targets == 0
as realloc(ptr, 0) frees ptr.  To stop this from happening, make sure we
always allocate at least one element.
@jmarshall
Copy link
Member

Thanks for tracking this down! I think the bug is more about the interplay between those lines and the later error-handling lines

hdr->target_name = target_name ? target_name : merged_hdr->target_name;
hdr->target_len  = target_len ? target_len : merged_hdr->target_len;

which are wrong when realloc(merged_hdr->target_name,0) frees merged_hdr->target_name and returns NULL. (Which is a glibc behaviour not shared by BSD libc btw…) So I fixed it differently in 90dcd90.

@jmarshall jmarshall closed this Dec 9, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants