Module Name: src Committed By: sjg Date: Tue Jun 18 19:31:27 UTC 2013
Modified Files: src/usr.bin/make: parse.c Log Message: Fix use after free bug. Parse_SetInput: curFile->fname was using the buffer passed to it - which ReadMakefile frees. This change makes the comment in ParseEOF about leaking curFile->fname true. To generate a diff of this commit: cvs rdiff -u -r1.188 -r1.189 src/usr.bin/make/parse.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/usr.bin/make/parse.c diff -u src/usr.bin/make/parse.c:1.188 src/usr.bin/make/parse.c:1.189 --- src/usr.bin/make/parse.c:1.188 Fri Mar 22 16:07:59 2013 +++ src/usr.bin/make/parse.c Tue Jun 18 19:31:27 2013 @@ -1,4 +1,4 @@ -/* $NetBSD: parse.c,v 1.188 2013/03/22 16:07:59 sjg Exp $ */ +/* $NetBSD: parse.c,v 1.189 2013/06/18 19:31:27 sjg Exp $ */ /* * Copyright (c) 1988, 1989, 1990, 1993 @@ -69,14 +69,14 @@ */ #ifndef MAKE_NATIVE -static char rcsid[] = "$NetBSD: parse.c,v 1.188 2013/03/22 16:07:59 sjg Exp $"; +static char rcsid[] = "$NetBSD: parse.c,v 1.189 2013/06/18 19:31:27 sjg Exp $"; #else #include <sys/cdefs.h> #ifndef lint #if 0 static char sccsid[] = "@(#)parse.c 8.3 (Berkeley) 3/19/94"; #else -__RCSID("$NetBSD: parse.c,v 1.188 2013/03/22 16:07:59 sjg Exp $"); +__RCSID("$NetBSD: parse.c,v 1.189 2013/06/18 19:31:27 sjg Exp $"); #endif #endif /* not lint */ #endif @@ -154,7 +154,7 @@ __RCSID("$NetBSD: parse.c,v 1.188 2013/0 * Structure for a file being read ("included file") */ typedef struct IFile { - const char *fname; /* name of file */ + char *fname; /* name of file */ int lineno; /* current line number in file */ int first_lineno; /* line number of start of text */ int cond_depth; /* 'if' nesting when file opened */ @@ -2334,7 +2334,7 @@ Parse_SetInput(const char *name, int lin * name of the include file so error messages refer to the right * place. */ - curFile->fname = name; + curFile->fname = bmake_strdup(name); curFile->lineno = line; curFile->first_lineno = line; curFile->nextbuf = nextbuf; @@ -2347,6 +2347,8 @@ Parse_SetInput(const char *name, int lin buf = curFile->nextbuf(curFile->nextbuf_arg, &len); if (buf == NULL) { /* Was all a waste of time ... */ + if (curFile->fname) + free(curFile->fname); free(curFile); return; }