[PATCH] sxpr dereferences freed memory

[PATCH] sxpr dereferences freed memory

[Charles Coffing]

[-- Attachment #1: Type: text/plain, Size: 288 bytes --]

The attached patch applies to 2.0-testing.

If the xfrd daemon receives a message that is immediately followed by an
EOF, without first seeing whitespace (usually a newline), the sxpr
parser will dereference freed memory.  The attached patch fixes the
dangling pointer.


Thanks,
Charles

[-- Attachment #2: sxpr_dangling.patch --]
[-- Type: application/octet-stream, Size: 669 bytes --]

===== tools/xfrd/sxpr_parser.c 1.1 vs edited =====
--- 1.1/tools/xfrd/sxpr_parser.c	2004-07-07 09:54:46 -06:00
+++ edited/tools/xfrd/sxpr_parser.c	2004-11-22 12:55:39 -07:00
@@ -242,6 +242,8 @@
     int err = 0;
     ParserState *s = p->state;
     p->state = s->parent;
+    if (p->start_state == s)
+        p->start_state = NULL;
     ParserState_free(s);
     return err;
 }
@@ -374,7 +376,7 @@
     if(CONSP(p->val)){
         v = p->val;
         p->val = ONONE;
-    } else if(CONSP(p->start_state->val)){
+    } else if(p->start_state && CONSP(p->start_state->val)){
         v = p->start_state->val;
         p->start_state->val = ONULL;
         v = nrev(v);