Author: delphij
Date: Thu May 14 23:09:33 2009
New Revision: 192129
URL: http://svn.freebsd.org/changeset/base/192129
Log:
As the comment says, close() frees the variable, record. So we obtain
the length by evaluating the value from the copy, cbuf instead. This
fixes a crash caused by previous commit (use-after-free)
Submitted by: Dimitry Andric <dimitry andric com>
Pointy hat to: delphij
Modified:
head/lib/libc/gen/getcap.c
Modified: head/lib/libc/gen/getcap.c
==============================================================================
--- head/lib/libc/gen/getcap.c Thu May 14 22:36:56 2009 (r192128)
+++ head/lib/libc/gen/getcap.c Thu May 14 23:09:33 2009 (r192129)
@@ -260,7 +260,7 @@ getent(char **cap, u_int *len, char **db
errno = ENOMEM;
return (-2);
}
- *len = strlen(record);
+ *len = strlen(cbuf);
*cap = cbuf;
return (retval);
} else {
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
