diff options
| author | Pedro F. Giffuni <pfg@FreeBSD.org> | 2016-07-29 16:14:03 +0000 |
|---|---|---|
| committer | Pedro F. Giffuni <pfg@FreeBSD.org> | 2016-07-29 16:14:03 +0000 |
| commit | 11821cabe8ee76e5c2d7d354866fd9a57857486e (patch) | |
| tree | 39491d0e6c1e81a71ced1507a022f92cf4cb03a3 /usr.bin/indent | |
| parent | 19fe172acee1d1d4a603bb670e619ae6afa1e21a (diff) | |
| download | src-11821cabe8ee76e5c2d7d354866fd9a57857486e.tar.gz src-11821cabe8ee76e5c2d7d354866fd9a57857486e.zip | |
indent(1): Avoid potential use-after-free.
last_bl is a char pointer that tracks the last blank character in a
comment, which is used for wrapping long comment lines. Since the
underlying array may be reallocated, make sure last_bl is up to date when
that happens.
Differential Revision: https://reviews.freebsd.org/D6966 (Partial)
Obtained from: Piotr Stefaniak
Notes
Notes:
svn path=/head/; revision=303483
Diffstat (limited to 'usr.bin/indent')
| -rw-r--r-- | usr.bin/indent/indent_globs.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/usr.bin/indent/indent_globs.h b/usr.bin/indent/indent_globs.h index 2ea1d8da7fbf..1e9970a8c951 100644 --- a/usr.bin/indent/indent_globs.h +++ b/usr.bin/indent/indent_globs.h @@ -71,6 +71,7 @@ FILE *output; /* the output file */ if (combuf == NULL) \ err(1, NULL); \ e_com = combuf + (e_com-s_com) + 1; \ + last_bl = combuf + (last_bl-s_com) + 1; \ l_com = combuf + nsize - 5; \ s_com = combuf + 1; \ } |