|
 |
206f5e |
commit 959b2001458bca8f9228014371aad6ccbeb95a68
|
|
|
206f5e |
Author: Zhi Li <yieli@redhat.com>
|
|
|
206f5e |
Date: Wed Sep 26 14:05:29 2018 -0400
|
|
|
206f5e |
|
|
|
206f5e |
getnetconfig.c: fix a BAD_FREE (CWE-763)
|
|
|
206f5e |
|
|
|
206f5e |
Signed-off-by: Steve Dickson <steved@redhat.com>
|
|
|
206f5e |
|
|
|
206f5e |
diff --git a/src/getnetconfig.c b/src/getnetconfig.c
|
|
|
206f5e |
index d67d97d..cfd33c2 100644
|
|
|
206f5e |
--- a/src/getnetconfig.c
|
|
|
206f5e |
+++ b/src/getnetconfig.c
|
|
|
206f5e |
@@ -681,6 +681,7 @@ struct netconfig *ncp;
|
|
|
206f5e |
{
|
|
|
206f5e |
struct netconfig *p;
|
|
|
206f5e |
char *tmp;
|
|
|
206f5e |
+ char *t;
|
|
|
206f5e |
u_int i;
|
|
|
206f5e |
|
|
|
206f5e |
if ((tmp=malloc(MAXNETCONFIGLINE)) == NULL)
|
|
|
206f5e |
@@ -700,22 +701,21 @@ struct netconfig *ncp;
|
|
|
206f5e |
*/
|
|
|
206f5e |
*p = *ncp;
|
|
|
206f5e |
p->nc_netid = (char *)strcpy(tmp,ncp->nc_netid);
|
|
|
206f5e |
- tmp = strchr(tmp, 0) + 1;
|
|
|
206f5e |
- p->nc_protofmly = (char *)strcpy(tmp,ncp->nc_protofmly);
|
|
|
206f5e |
- tmp = strchr(tmp, 0) + 1;
|
|
|
206f5e |
- p->nc_proto = (char *)strcpy(tmp,ncp->nc_proto);
|
|
|
206f5e |
- tmp = strchr(tmp, 0) + 1;
|
|
|
206f5e |
- p->nc_device = (char *)strcpy(tmp,ncp->nc_device);
|
|
|
206f5e |
+ t = strchr(tmp, 0) + 1;
|
|
|
206f5e |
+ p->nc_protofmly = (char *)strcpy(t,ncp->nc_protofmly);
|
|
|
206f5e |
+ t = strchr(t, 0) + 1;
|
|
|
206f5e |
+ p->nc_proto = (char *)strcpy(t,ncp->nc_proto);
|
|
|
206f5e |
+ t = strchr(t, 0) + 1;
|
|
|
206f5e |
+ p->nc_device = (char *)strcpy(t,ncp->nc_device);
|
|
|
206f5e |
p->nc_lookups = (char **)malloc((size_t)(p->nc_nlookups+1) * sizeof(char *));
|
|
|
206f5e |
if (p->nc_lookups == NULL) {
|
|
|
206f5e |
- free(p->nc_netid);
|
|
|
206f5e |
free(p);
|
|
|
206f5e |
free(tmp);
|
|
|
206f5e |
return(NULL);
|
|
|
206f5e |
}
|
|
|
206f5e |
for (i=0; i < p->nc_nlookups; i++) {
|
|
|
206f5e |
- tmp = strchr(tmp, 0) + 1;
|
|
|
206f5e |
- p->nc_lookups[i] = (char *)strcpy(tmp,ncp->nc_lookups[i]);
|
|
|
206f5e |
+ t = strchr(t, 0) + 1;
|
|
|
206f5e |
+ p->nc_lookups[i] = (char *)strcpy(t,ncp->nc_lookups[i]);
|
|
|
206f5e |
}
|
|
|
206f5e |
return(p);
|
|
|
206f5e |
}
|