diff options
| author | Jan Beich <jbeich@FreeBSD.org> | 2017-05-12 22:33:54 +0000 |
|---|---|---|
| committer | Jan Beich <jbeich@FreeBSD.org> | 2017-05-12 22:33:54 +0000 |
| commit | af98de3b3e89fabea96cf9f19fd30ab810975a31 (patch) | |
| tree | 42c27c13e75c502c00d467640cdcfb9674a0cf78 | |
| parent | aa38b49434743a393311303b024a433df3a3745c (diff) | |
games/acm: prevent free()ing unitialized data
acm may coredump immediately after starting on systems which do not
zero malloc()ed memory e.g., MALLOC_CONF=junk:true. This is because
one of the fields of a malloc()ed data structure (w) contains a
pointer (w->csPool2), and if that pointer is never used, then later
code will find the pointer is non-NULL and try to free() the memory
pointed to by the pointer.
PR: 215427
Submitted by: Jeff Gibbons <jgibbons@protogate.com>
Notes
Notes:
svn path=/head/; revision=440736
| -rw-r--r-- | games/acm/Makefile | 2 | ||||
| -rw-r--r-- | games/acm/files/patch-V_lib_InitAWin.c | 16 |
2 files changed, 17 insertions, 1 deletions
diff --git a/games/acm/Makefile b/games/acm/Makefile index a6a80147f087..696dfc034852 100644 --- a/games/acm/Makefile +++ b/games/acm/Makefile @@ -3,7 +3,7 @@ PORTNAME= acm PORTVERSION= 5.0 -PORTREVISION= 2 +PORTREVISION= 3 CATEGORIES= games MASTER_SITES= http://mirror.amdmi3.ru/distfiles/ diff --git a/games/acm/files/patch-V_lib_InitAWin.c b/games/acm/files/patch-V_lib_InitAWin.c new file mode 100644 index 000000000000..98994057ee19 --- /dev/null +++ b/games/acm/files/patch-V_lib_InitAWin.c @@ -0,0 +1,16 @@ +--- V/lib/InitAWin.c.orig 1998-08-14 21:09:02 UTC ++++ V/lib/InitAWin.c +@@ -69,6 +69,13 @@ InitializeX11AWindow(Display * dpy, int screen, Drawab + w->csPool1 = (ColorSegment *) malloc(w->CSSize1 * sizeof(ColorSegment)); + memset(w->csPool1, 0, w->CSSize1 * sizeof(ColorSegment)); + ++ // Initialize csPool2 so program doesn't crash later, ++ // when trying to free it. ++ { ++ w->CSSize2 = 0; ++ w->csPool2 = (ColorSegment *) NULL; ++ } ++ + w->scanLine = (ScanLine *) malloc((w->height + 1) * sizeof(ScanLine)); + w->lastScanLine = (ScanLine *) malloc((w->height + 1) * sizeof(ScanLine)); + w->otherLastScanLine = NULL; |