DeforaOS/Browser
DeforaOS/Browser
2
0
Fork 0
Code Issues 2 Pull Requests Packages Projects Releases Wiki Activity

Avoid potential memory corruption with dirname(3)

Browse Source 
This notably happens on NetBSD, where dirname(3) returns an address from
static storage.
This commit is contained in:
Pierre Pronchery 2018-02-10 14:14:17 +01:00
parent 10e0337564
commit d7b63188e1
1 changed files with 10 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
src/plugins/git.c
View File

@ -373,42 +373,37 @@ static void _refresh_hide(Git * git, gboolean name)
/* git_get_base */ /* git_get_base */
static String * _git_get_base(Git * git, char const * filename) static String * _git_get_base(Git * git, char const * filename)
{ {
BrowserPluginHelper * helper = git->helper; String * cur;
String * base;
String * dir; String * dir;
String * p; String * p;
struct stat st; struct stat st;
int res; int res;
(void) git;
#ifdef DEBUG #ifdef DEBUG
fprintf(stderr, "DEBUG: %s(\"%s\")\n", __func__, filename); fprintf(stderr, "DEBUG: %s(\"%s\")\n", __func__, filename);
#endif #endif
if((base = string_new(filename)) == NULL) cur = g_path_get_dirname(filename);
{ for(dir = cur; string_compare(dir, ".") != 0;
helper->error(helper->browser, error_get(NULL), 1); dir = g_path_get_dirname(cur))
return NULL;
}
dir = base;
for(; string_compare(dir, ".") != 0; dir = dirname(dir))
{ {
g_free(cur);
cur = dir;
if((p = string_new_append(dir, "/.git", NULL)) == NULL) if((p = string_new_append(dir, "/.git", NULL)) == NULL)
{ break;
string_delete(base);
return NULL;
}
res = lstat(p, &st); res = lstat(p, &st);
#ifdef DEBUG #ifdef DEBUG
fprintf(stderr, "DEBUG: %s() \"%s\" %d\n", __func__, p, res); fprintf(stderr, "DEBUG: %s() \"%s\" %d\n", __func__, p, res);
#endif #endif
if(res == 0) if(res == 0)
{ {
string_delete(base); g_free(cur);
return p; return p;
} }
if(string_compare(dir, "/") == 0) if(string_compare(dir, "/") == 0)
break; break;
} }
string_delete(base); g_free(cur);
return NULL; return NULL;
} }