diff options
| author |   millert <millert@openbsd.org> | 2015-07-14 17:18:48 +0000 |
|---|---|---|
| committer | millert <millert@openbsd.org> | 2015-07-14 17:18:48 +0000 |
| commit | 78fa7b9720db69acb11df7e13d4f384c9bc114b9 (patch) | |
| tree | 3f94c8dabd7dd7bafe6570491a75da82e6f3b4ff /usr.bin/find/misc.c | |
| parent | Convert the last remaining realloc() in find to reallocarray(). (diff) | |
| download | wireguard-openbsd-78fa7b9720db69acb11df7e13d4f384c9bc114b9.tar.xz wireguard-openbsd-78fa7b9720db69acb11df7e13d4f384c9bc114b9.zip | |
Don't dereference a freed pointer when updating the value of p.
Noted by tedu@
Diffstat (limited to 'usr.bin/find/misc.c')
| -rw-r--r-- | usr.bin/find/misc.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/usr.bin/find/misc.c b/usr.bin/find/misc.c index f74b0d467ea..c4f358cadfd 100644 --- a/usr.bin/find/misc.c +++ b/usr.bin/find/misc.c @@ -1,4 +1,4 @@ -/* $OpenBSD: misc.c,v 1.14 2015/07/14 16:58:22 millert Exp $ */ +/* $OpenBSD: misc.c,v 1.15 2015/07/14 17:18:48 millert Exp $ */ /*- * Copyright (c) 1990, 1993 @@ -39,6 +39,7 @@ #include <err.h> #include <errno.h> #include <fts.h> +#include <stddef.h> #include <stdio.h> #include <stdlib.h> #include <string.h> @@ -60,12 +61,14 @@ brace_subst(char *orig, char **store, char *path, int len) for (p = *store; (ch = *orig); ++orig) if (ch == '{' && orig[1] == '}') { while ((p - *store) + plen > len) { + ptrdiff_t p_off; char *newstore; + p_off = (p - *store); newstore = reallocarray(*store, len, 2); if (newstore == NULL) err(1, NULL); - p = (p - *store) + newstore; + p = newstore + p_off; *store = newstore; len *= 2; } |