Mercurial > vim
view src/proto/message.pro @ 34627:5071d4c3ff2e v9.1.0202
patch 9.1.0202: leaking memory in add_user() on failure
Commit: https://github.com/vim/vim/commit/7a2f217988afa1c35b9c093a9d3477198ea250b9
Author: Christian Brabandt <cb@256bit.org>
Date: Sun Mar 24 09:50:03 2024 +0100
patch 9.1.0202: leaking memory in add_user() on failure
Problem: leaking memory in add_user() (LuMingYinDetect)
Solution: free user_copy pointer instead of the user ptr
add_user() is called with a user pointer and the user pointer comes
from these functions:
- return value from the getpwent() function (Unix).
- return value from the getpwnam() function (Unix).
- return value from the NetUserEnum() function (MS Windows).
For the first 2 callers, the man page for those functions directly says,
one should not free the returned pointer (since it comes from static
memory).
For the third caller (on MS Windows), the returned buffer is already
freed directly after calling the add_user() function in
NetApiBufferFree(), so this would lead to a double free().
This all indicates, the user ptr is wrongly freed in the add_user()
function and the intention was to free the user_copy pointer instead in
case of an error.
So let's just use that now.
fixes: #14250
closes: #14260
Signed-off-by: Christian Brabandt <cb@256bit.org>
author | Christian Brabandt <cb@256bit.org> |
---|---|
date | Sun, 24 Mar 2024 10:00:09 +0100 |
parents | b6b803ed4a53 |
children |
line wrap: on
line source
/* message.c */ int msg(char *s); int verb_msg(char *s); int msg_attr(char *s, int attr); int msg_attr_keep(char *s, int attr, int keep); char_u *msg_strtrunc(char_u *s, int force); void trunc_string(char_u *s, char_u *buf, int room_in, int buflen); void reset_last_sourcing(void); void msg_source(int attr); void ignore_error_for_testing(char_u *error); void do_perror(char *msg); int emsg(char *s); void iemsg(char *s); void internal_error(char *where); void internal_error_no_abort(char *where); void emsg_invreg(int name); void emsg_namelen(char *msg, char_u *name, int len); char *msg_trunc_attr(char *s, int force, int attr); char_u *msg_may_trunc(int force, char_u *s); int delete_first_msg(void); void ex_messages(exarg_T *eap); void msg_end_prompt(void); void wait_return(int redraw); void set_keep_msg(char_u *s, int attr); void set_keep_msg_from_hist(void); void msg_start(void); void msg_starthere(void); void msg_putchar(int c); void msg_putchar_attr(int c, int attr); void msg_outnum(long n); void msg_home_replace(char_u *fname); void msg_home_replace_hl(char_u *fname); int msg_outtrans(char_u *str); int msg_outtrans_attr(char_u *str, int attr); int msg_outtrans_len(char_u *str, int len); char_u *msg_outtrans_one(char_u *p, int attr); int msg_outtrans_len_attr(char_u *msgstr, int len, int attr); void msg_make(char_u *arg); int msg_outtrans_special(char_u *strstart, int from, int maxlen); char_u *str2special_save(char_u *str, int replace_spaces, int replace_lt); char_u *str2special(char_u **sp, int replace_spaces, int replace_lt); void str2specialbuf(char_u *sp, char_u *buf, int len); void msg_prt_line(char_u *s, int list); void msg_puts(char *s); void msg_puts_title(char *s); void msg_outtrans_long_attr(char_u *longstr, int attr); void msg_puts_attr(char *s, int attr); int message_filtered(char_u *msg); void may_clear_sb_text(void); void sb_text_start_cmdline(void); void sb_text_restart_cmdline(void); void sb_text_end_cmdline(void); void clear_sb_text(int all); void show_sb_text(void); void msg_sb_eol(void); int msg_use_printf(void); void mch_errmsg(char *str); void mch_msg(char *str); void repeat_message(void); void msg_clr_eos(void); void msg_clr_eos_force(void); void msg_clr_cmdline(void); int msg_end(void); void msg_check(void); int redirecting(void); void verbose_enter(void); void verbose_leave(void); void verbose_enter_scroll(void); void verbose_leave_scroll(void); void verbose_stop(void); int verbose_open(void); void give_warning(char_u *message, int hl); void give_warning_with_source(char_u *message, int hl, int with_source); void give_warning2(char_u *message, char_u *a1, int hl); void msg_advance(int col); int do_dialog(int type, char_u *title, char_u *message, char_u *buttons, int dfltbutton, char_u *textfield, int ex_cmd); int vim_dialog_yesno(int type, char_u *title, char_u *message, int dflt); int vim_dialog_yesnocancel(int type, char_u *title, char_u *message, int dflt); int vim_dialog_yesnoallcancel(int type, char_u *title, char_u *message, int dflt); /* vim: set ft=c : */