diff options
| author | Don Lewis <truckman@FreeBSD.org> | 2016-05-13 06:15:05 +0000 |
|---|---|---|
| committer | Don Lewis <truckman@FreeBSD.org> | 2016-05-13 06:15:05 +0000 |
| commit | 090fc1c839eadf0cf69686492e84917561b6a9bf (patch) | |
| tree | f1b05c53cbabc238619d5a26c337866c3cd74c4e /usr.bin/mail | |
| parent | dde1276e8ea21c039c93695e8c18c7dafdfa6793 (diff) | |
| download | src-090fc1c839eadf0cf69686492e84917561b6a9bf.tar.gz src-090fc1c839eadf0cf69686492e84917561b6a9bf.zip | |
Always return either a dynamically allocated string or NULL from
expand(). Never return the name parameter, which could be a the buf[]
buffer which is allocated on the stack by getdeadletter() and which
would then be used after getdeadletter() has returned.
Reported by: Coverity
CID: 1199383
MFC after: 1 week
Notes
Notes:
svn path=/head/; revision=299591
Diffstat (limited to 'usr.bin/mail')
| -rw-r--r-- | usr.bin/mail/fio.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/usr.bin/mail/fio.c b/usr.bin/mail/fio.c index 1b0efeaf6eb5..d9d4ee1a24ab 100644 --- a/usr.bin/mail/fio.c +++ b/usr.bin/mail/fio.c @@ -367,10 +367,10 @@ expand(char *name) name = savestr(xname); } if (!strpbrk(name, "~{[*?$`'\"\\")) - return (name); + return (savestr(name)); if (pipe(pivec) < 0) { warn("pipe"); - return (name); + return (NULL); } (void)snprintf(cmdbuf, sizeof(cmdbuf), "echo %s", name); if ((sh = value("SHELL")) == NULL) |