Author: truckman
Date: Fri May 13 06:15:05 2016
New Revision: 299591
URL: https://svnweb.freebsd.org/changeset/base/299591
Log:
Always return either a dynamically allocated string or NULL from
expand(). Never return the name parameter, which could be a the buf[]
buffer which is allocated on the stack by getdeadletter() and which
would then be used after getdeadletter() has returned.
Reported by: Coverity
CID: 1199383
MFC after: 1 week
Modified:
head/usr.bin/mail/fio.c
Modified: head/usr.bin/mail/fio.c
==============================================================================
--- head/usr.bin/mail/fio.c Fri May 13 05:57:21 2016 (r299590)
+++ head/usr.bin/mail/fio.c Fri May 13 06:15:05 2016 (r299591)
@@ -367,10 +367,10 @@ expand(char *name)
name = savestr(xname);
}
if (!strpbrk(name, "~{[*?$`'\"\\"))
- return (name);
+ return (savestr(name));
if (pipe(pivec) < 0) {
warn("pipe");
- return (name);
+ return (NULL);
}
(void)snprintf(cmdbuf, sizeof(cmdbuf), "echo %s", name);
if ((sh = value("SHELL")) == NULL)
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
