|
 |
007e4b |
commit 959b2001458bca8f9228014371aad6ccbeb95a68
|
|
|
007e4b |
Author: Zhi Li <yieli@redhat.com>
|
|
|
007e4b |
Date: Wed Sep 26 14:05:29 2018 -0400
|
|
|
007e4b |
|
|
|
007e4b |
getnetconfig.c: fix a BAD_FREE (CWE-763)
|
|
|
007e4b |
|
|
|
007e4b |
Signed-off-by: Steve Dickson <steved@redhat.com>
|
|
|
007e4b |
|
|
|
007e4b |
diff --git a/src/getnetconfig.c b/src/getnetconfig.c
|
|
|
007e4b |
index d67d97d..cfd33c2 100644
|
|
|
007e4b |
--- a/src/getnetconfig.c
|
|
|
007e4b |
+++ b/src/getnetconfig.c
|
|
|
007e4b |
@@ -681,6 +681,7 @@ struct netconfig *ncp;
|
|
|
007e4b |
{
|
|
|
007e4b |
struct netconfig *p;
|
|
|
007e4b |
char *tmp;
|
|
|
007e4b |
+ char *t;
|
|
|
007e4b |
u_int i;
|
|
|
007e4b |
|
|
|
007e4b |
if ((tmp=malloc(MAXNETCONFIGLINE)) == NULL)
|
|
|
007e4b |
@@ -700,22 +701,21 @@ struct netconfig *ncp;
|
|
|
007e4b |
*/
|
|
|
007e4b |
*p = *ncp;
|
|
|
007e4b |
p->nc_netid = (char *)strcpy(tmp,ncp->nc_netid);
|
|
|
007e4b |
- tmp = strchr(tmp, 0) + 1;
|
|
|
007e4b |
- p->nc_protofmly = (char *)strcpy(tmp,ncp->nc_protofmly);
|
|
|
007e4b |
- tmp = strchr(tmp, 0) + 1;
|
|
|
007e4b |
- p->nc_proto = (char *)strcpy(tmp,ncp->nc_proto);
|
|
|
007e4b |
- tmp = strchr(tmp, 0) + 1;
|
|
|
007e4b |
- p->nc_device = (char *)strcpy(tmp,ncp->nc_device);
|
|
|
007e4b |
+ t = strchr(tmp, 0) + 1;
|
|
|
007e4b |
+ p->nc_protofmly = (char *)strcpy(t,ncp->nc_protofmly);
|
|
|
007e4b |
+ t = strchr(t, 0) + 1;
|
|
|
007e4b |
+ p->nc_proto = (char *)strcpy(t,ncp->nc_proto);
|
|
|
007e4b |
+ t = strchr(t, 0) + 1;
|
|
|
007e4b |
+ p->nc_device = (char *)strcpy(t,ncp->nc_device);
|
|
|
007e4b |
p->nc_lookups = (char **)malloc((size_t)(p->nc_nlookups+1) * sizeof(char *));
|
|
|
007e4b |
if (p->nc_lookups == NULL) {
|
|
|
007e4b |
- free(p->nc_netid);
|
|
|
007e4b |
free(p);
|
|
|
007e4b |
free(tmp);
|
|
|
007e4b |
return(NULL);
|
|
|
007e4b |
}
|
|
|
007e4b |
for (i=0; i < p->nc_nlookups; i++) {
|
|
|
007e4b |
- tmp = strchr(tmp, 0) + 1;
|
|
|
007e4b |
- p->nc_lookups[i] = (char *)strcpy(tmp,ncp->nc_lookups[i]);
|
|
|
007e4b |
+ t = strchr(t, 0) + 1;
|
|
|
007e4b |
+ p->nc_lookups[i] = (char *)strcpy(t,ncp->nc_lookups[i]);
|
|
|
007e4b |
}
|
|
|
007e4b |
return(p);
|
|
|
007e4b |
}
|