Re: [PATCH hail] lib/hstor.c: avoid an unconditional leak in append_qparam

[Pete Zaitcev <zaitcev@xxxxxxxxxx>]

On Mon, 27 Sep 2010 10:53:06 +0200
Jim Meyering <jim@xxxxxxxxxxxx> wrote:

> -	stmp = huri_field_escape(strdup(val), QUERY_ESCAPE_MASK);
> +	v = strdup(val);
> +	stmp = huri_field_escape(v, QUERY_ESCAPE_MASK);
>  	str = g_string_append(str, stmp);
>  	free(stmp);
> +	free(v);

I think you may be fooled by the ridiculous calling convention
of huri_field_escape(). It takes a pointer to heap, then either
returns its argument, or reallocates it, frees the argument, and
returns the reallocated area. It frees with g_free, so it assumes
its equivalence with free(), haha.

The end result, it either returns what strdup returned of frees it.
Therefore if you free what strudup returned, you double-free it.

I honestly think this madness must stop and huri_field_escape
must allocate a new buffer every time. Then we would not need
the strdup there at all. It only exists to satisfy the requirement
to pass a pointer to heap in case val is a const or whatnot.

-- Pete
--
To unsubscribe from this list: send the line "unsubscribe hail-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html