Page MenuHomeFreeBSD

diff: Fix a use after free as well as a memory leak in change().
ClosedPublic

Authored by jhb on Sep 29 2022, 10:34 PM.
Tags
None
Referenced Files
F107031093: D36822.id111393.diff
Thu, Jan 9, 5:54 AM
F107031089: D36822.id.diff
Thu, Jan 9, 5:54 AM
F107031086: D36822.id111240.diff
Thu, Jan 9, 5:54 AM
F107029261: D36822.diff
Thu, Jan 9, 5:12 AM
Unknown Object (File)
Dec 2 2024, 10:30 AM
Unknown Object (File)
Nov 16 2024, 11:16 AM
Unknown Object (File)
Nov 16 2024, 10:13 AM
Unknown Object (File)
Oct 19 2024, 2:07 AM
Subscribers
None

Details

Summary

When -B or -I are used, change() evaluates the lines in a hunk to
determine if it is a hunk that should be ignored. It does this by
reading each candidate line into a mallocated buffer via preadline()
and then calling ignoreline(). Previously the buffer was freed as a
side effect of ignoreline_pattern() called from ignoreline().
However, if only -B was specified, then ignoreline_pattern() was not
called and the lines were leaked. If both options were specified,
then ignoreline_pattern() was called before checking for a blank line
so that the second check was a use after free.

To fix, pull the free() out of ignoreline_pattern() and instead do it
up in change() so that is paired with preadline().

While here, simplify ignoreline() by checking for the -B and -I cases
individually without a separate clause for when both are set. Also,
do the cheaper check (-B) first, and remove a false comment (this
function is only caused if at least one of -I or -B are specified).

Reported by: GCC 12 -Wuse-after-free

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable