diff options
| author | Stephen J. Kiernan <stevek@FreeBSD.org> | 2017-06-01 19:21:30 +0000 |
|---|---|---|
| committer | Stephen J. Kiernan <stevek@FreeBSD.org> | 2017-06-01 19:21:30 +0000 |
| commit | 3fab177f90d39618c9a15ebf1db796d3f9eef725 (patch) | |
| tree | b8a806aa11f8a51c69b270ca7e48ce612a75acfa /contrib/telnet | |
| parent | 1431a748454908de22e425c5ddf35d2b65a46ea6 (diff) | |
| download | src-3fab177f90d39618c9a15ebf1db796d3f9eef725.tar.gz src-3fab177f90d39618c9a15ebf1db796d3f9eef725.zip | |
Fix memory leak in edithost
The problem is that when the parameter 'pat' is null, the function locally
allocates a NULL string but never frees it.
Instead of tracking the local alloc, it is noted that the while(*pat) never
enters when there is a local alloc.
So instead of doing the local alloc, check that 'pat' is null before the
while(*pat) loop.
Found using clang's static analyzer - scan-build
Submitted by: Thomas Rix <trix@juniper.net>
Reviewed by: markm
Approved by: sjg (mentor)
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D9689
Notes
Notes:
svn path=/head/; revision=319453
Diffstat (limited to 'contrib/telnet')
| -rw-r--r-- | contrib/telnet/telnetd/utility.c | 42 |
1 files changed, 21 insertions, 21 deletions
diff --git a/contrib/telnet/telnetd/utility.c b/contrib/telnet/telnetd/utility.c index 905fd3b2d65d..1d3731e1c706 100644 --- a/contrib/telnet/telnetd/utility.c +++ b/contrib/telnet/telnetd/utility.c @@ -360,30 +360,30 @@ edithost(char *pat, char *host) { char *res = editedhost; - if (!pat) - pat = strdup(""); - while (*pat) { - switch (*pat) { - - case '#': - if (*host) - host++; - break; + if (pat) { + while (*pat) { + switch (*pat) { - case '@': - if (*host) - *res++ = *host++; - break; + case '#': + if (*host) + host++; + break; - default: - *res++ = *pat; - break; - } - if (res == &editedhost[sizeof editedhost - 1]) { - *res = '\0'; - return; + case '@': + if (*host) + *res++ = *host++; + break; + + default: + *res++ = *pat; + break; + } + if (res == &editedhost[sizeof editedhost - 1]) { + *res = '\0'; + return; + } + pat++; } - pat++; } if (*host) (void) strncpy(res, host, |