ahp/busybox
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

bc: hopefully fix bug 14956 (use-after-free)

Browse source 
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
This commit is contained in:
Denys Vlasenko 2022-08-18 16:23:55 +02:00
parent 7c2a3bdde0
commit 41d5f800a1
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
miscutils/bc.c
View file

@ -2892,6 +2892,8 @@ static char peek_inbuf(void)
) { ) {
xc_read_line(&G.input_buffer, G.prs.lex_input_fp); xc_read_line(&G.input_buffer, G.prs.lex_input_fp);
G.prs.lex_inbuf = G.input_buffer.v; G.prs.lex_inbuf = G.input_buffer.v;
// lex_next_at may point to now-freed data, update it:
G.prs.lex_next_at = G.prs.lex_inbuf;
if (G.input_buffer.len <= 1) // on EOF, len is 1 (NUL byte) if (G.input_buffer.len <= 1) // on EOF, len is 1 (NUL byte)
G.prs.lex_input_fp = NULL; G.prs.lex_input_fp = NULL;
} }