summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJim Meyering <meyering@redhat.com>2012-09-18 10:10:38 +0200
committerJames Youngman <jay@gnu.org>2012-11-17 13:15:25 +0000
commite17d58833bb6884d0fe17e2c738b0bb9e3654c6e (patch)
treec544165d916b897d339a8050e0ca59267dabf21d
parente04bf28703e7a203fee35b163992639d84ab0aa3 (diff)
downloadfindutils-e17d58833b.tar.gz
find: fix two time-formatting leaks (bug #37356)
* find/print.c (do_time_format): Call xmalloc for static "buf" only the first time. When reallocating buf, be sure to update its buf_size. Also free "altbuf". Reported by Nemo Maelstrom Thorx in http://bugs.debian.org/687358 via Andreas Metzler in http://savannah.gnu.org/bugs/?37356
-rw-r--r--ChangeLog8
-rw-r--r--find/print.c11
2 files changed, 16 insertions, 3 deletions
diff --git a/ChangeLog b/ChangeLog
index 5f1158d..4f882b8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,13 @@
2012-09-18 Jim Meyering <meyering@redhat.com>
+ find: fix two time-formatting leaks (bug #37356)
+ * find/print.c (do_time_format): Call xmalloc for static "buf" only
+ the first time.
+ When reallocating buf, be sure to update its buf_size.
+ Also free "altbuf".
+ Reported by Nemo Maelstrom Thorx in http://bugs.debian.org/687358
+ via Andreas Metzler in http://savannah.gnu.org/bugs/?37356
+
find: minor tweaks
* find/print.c (do_time_format): Use memcpy in place of sprintf.
When calling x2nrealloc, use "sizeof *buf" as the element size,
diff --git a/find/print.c b/find/print.c
index 8eb5acd..5d35172 100644
--- a/find/print.c
+++ b/find/print.c
@@ -1,6 +1,6 @@
/* print.c -- print/printf-related code.
Copyright (C) 1990, 1991, 1992, 1993, 1994, 2000, 2001, 2003, 2004,
- 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software Foundation,
+ 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Free Software Foundation,
Inc.
This program is free software: you can redistribute it and/or modify
@@ -509,8 +509,11 @@ do_time_format (const char *fmt, const struct tm *p, const char *ns, size_t ns_s
* on Solaris, since it unconditionally writes the terminating null
* character.
*/
- buf_size = 1u;
- buf = xmalloc (buf_size);
+ if (buf == NULL)
+ {
+ buf_size = 1u;
+ buf = xmalloc (buf_size);
+ }
while (true)
{
/* I'm not sure that Solaris will return 0 when the buffer is too small.
@@ -527,6 +530,7 @@ do_time_format (const char *fmt, const struct tm *p, const char *ns, size_t ns_s
+ 1u /* for \0 */
+ ns_size);
buf = xrealloc (buf, final_len);
+ buf_size = final_len;
altbuf = xmalloc (final_len);
strftime (altbuf, buf_size, timefmt, &altered_time);
@@ -561,6 +565,7 @@ do_time_format (const char *fmt, const struct tm *p, const char *ns, size_t ns_s
* don't want.
*/
free (timefmt);
+ free (altbuf);
return buf+1;
}
else