diff options
| author | Jim Meyering <meyering@redhat.com> | 2012-09-18 10:10:38 +0200 |
|---|---|---|
| committer | James Youngman <jay@gnu.org> | 2012-11-17 13:15:25 +0000 |
| commit | e17d58833bb6884d0fe17e2c738b0bb9e3654c6e (patch) | |
| tree | c544165d916b897d339a8050e0ca59267dabf21d | |
| parent | e04bf28703e7a203fee35b163992639d84ab0aa3 (diff) | |
| download | findutils-e17d58833b.tar.gz | |
find: fix two time-formatting leaks (bug #37356)
* find/print.c (do_time_format): Call xmalloc for static "buf" only
the first time.
When reallocating buf, be sure to update its buf_size.
Also free "altbuf".
Reported by Nemo Maelstrom Thorx in http://bugs.debian.org/687358
via Andreas Metzler in http://savannah.gnu.org/bugs/?37356
| -rw-r--r-- | ChangeLog | 8 | ||||
| -rw-r--r-- | find/print.c | 11 |
2 files changed, 16 insertions, 3 deletions
@@ -1,5 +1,13 @@ 2012-09-18 Jim Meyering <meyering@redhat.com> + find: fix two time-formatting leaks (bug #37356) + * find/print.c (do_time_format): Call xmalloc for static "buf" only + the first time. + When reallocating buf, be sure to update its buf_size. + Also free "altbuf". + Reported by Nemo Maelstrom Thorx in http://bugs.debian.org/687358 + via Andreas Metzler in http://savannah.gnu.org/bugs/?37356 + find: minor tweaks * find/print.c (do_time_format): Use memcpy in place of sprintf. When calling x2nrealloc, use "sizeof *buf" as the element size, diff --git a/find/print.c b/find/print.c index 8eb5acd..5d35172 100644 --- a/find/print.c +++ b/find/print.c @@ -1,6 +1,6 @@ /* print.c -- print/printf-related code. Copyright (C) 1990, 1991, 1992, 1993, 1994, 2000, 2001, 2003, 2004, - 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software Foundation, + 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Free Software Foundation, Inc. This program is free software: you can redistribute it and/or modify @@ -509,8 +509,11 @@ do_time_format (const char *fmt, const struct tm *p, const char *ns, size_t ns_s * on Solaris, since it unconditionally writes the terminating null * character. */ - buf_size = 1u; - buf = xmalloc (buf_size); + if (buf == NULL) + { + buf_size = 1u; + buf = xmalloc (buf_size); + } while (true) { /* I'm not sure that Solaris will return 0 when the buffer is too small. @@ -527,6 +530,7 @@ do_time_format (const char *fmt, const struct tm *p, const char *ns, size_t ns_s + 1u /* for \0 */ + ns_size); buf = xrealloc (buf, final_len); + buf_size = final_len; altbuf = xmalloc (final_len); strftime (altbuf, buf_size, timefmt, &altered_time); @@ -561,6 +565,7 @@ do_time_format (const char *fmt, const struct tm *p, const char *ns, size_t ns_s * don't want. */ free (timefmt); + free (altbuf); return buf+1; } else |
