Module Name: src Committed By: bouyer Date: Sun Mar 20 12:36:15 UTC 2011
Modified Files: src/lib/libedit: el.c Log Message: Fix use-after-free. Discovered by running tests with MALLOC_OPTIONS=J (should this be the default for tests ?), pointed out by njoly@ To generate a diff of this commit: cvs rdiff -u -r1.61 -r1.62 src/lib/libedit/el.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/lib/libedit/el.c diff -u src/lib/libedit/el.c:1.61 src/lib/libedit/el.c:1.62 --- src/lib/libedit/el.c:1.61 Thu Jan 27 23:11:40 2011 +++ src/lib/libedit/el.c Sun Mar 20 12:36:14 2011 @@ -1,4 +1,4 @@ -/* $NetBSD: el.c,v 1.61 2011/01/27 23:11:40 christos Exp $ */ +/* $NetBSD: el.c,v 1.62 2011/03/20 12:36:14 bouyer Exp $ */ /*- * Copyright (c) 1992, 1993 @@ -37,7 +37,7 @@ #if 0 static char sccsid[] = "@(#)el.c 8.2 (Berkeley) 1/3/94"; #else -__RCSID("$NetBSD: el.c,v 1.61 2011/01/27 23:11:40 christos Exp $"); +__RCSID("$NetBSD: el.c,v 1.62 2011/03/20 12:36:14 bouyer Exp $"); #endif #endif /* not lint && not SCCSID */ @@ -135,13 +135,13 @@ sig_end(el); el_free((ptr_t) el->el_prog); - el_free((ptr_t) el); #ifdef WIDECHAR el_free((ptr_t) el->el_scratch.cbuff); el_free((ptr_t) el->el_scratch.wbuff); el_free((ptr_t) el->el_lgcyconv.cbuff); el_free((ptr_t) el->el_lgcyconv.wbuff); #endif + el_free((ptr_t) el); }