Module Name:    src
Committed By:   bouyer
Date:           Sun Mar 20 12:36:15 UTC 2011

Modified Files:
        src/lib/libedit: el.c

Log Message:
Fix use-after-free. Discovered by running tests with MALLOC_OPTIONS=J
(should this be the default for tests ?), pointed out by njoly@


To generate a diff of this commit:
cvs rdiff -u -r1.61 -r1.62 src/lib/libedit/el.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/lib/libedit/el.c
diff -u src/lib/libedit/el.c:1.61 src/lib/libedit/el.c:1.62
--- src/lib/libedit/el.c:1.61	Thu Jan 27 23:11:40 2011
+++ src/lib/libedit/el.c	Sun Mar 20 12:36:14 2011
@@ -1,4 +1,4 @@
-/*	$NetBSD: el.c,v 1.61 2011/01/27 23:11:40 christos Exp $	*/
+/*	$NetBSD: el.c,v 1.62 2011/03/20 12:36:14 bouyer Exp $	*/
 
 /*-
  * Copyright (c) 1992, 1993
@@ -37,7 +37,7 @@
 #if 0
 static char sccsid[] = "@(#)el.c	8.2 (Berkeley) 1/3/94";
 #else
-__RCSID("$NetBSD: el.c,v 1.61 2011/01/27 23:11:40 christos Exp $");
+__RCSID("$NetBSD: el.c,v 1.62 2011/03/20 12:36:14 bouyer Exp $");
 #endif
 #endif /* not lint && not SCCSID */
 
@@ -135,13 +135,13 @@
 	sig_end(el);
 
 	el_free((ptr_t) el->el_prog);
-	el_free((ptr_t) el);
 #ifdef WIDECHAR
 	el_free((ptr_t) el->el_scratch.cbuff);
 	el_free((ptr_t) el->el_scratch.wbuff);
 	el_free((ptr_t) el->el_lgcyconv.cbuff);
 	el_free((ptr_t) el->el_lgcyconv.wbuff);
 #endif
+	el_free((ptr_t) el);
 }
 
 

Reply via email to