Mercurial > vim
view src/proto/typval.pro @ 34627:5071d4c3ff2e v9.1.0202
patch 9.1.0202: leaking memory in add_user() on failure
Commit: https://github.com/vim/vim/commit/7a2f217988afa1c35b9c093a9d3477198ea250b9
Author: Christian Brabandt <cb@256bit.org>
Date: Sun Mar 24 09:50:03 2024 +0100
patch 9.1.0202: leaking memory in add_user() on failure
Problem: leaking memory in add_user() (LuMingYinDetect)
Solution: free user_copy pointer instead of the user ptr
add_user() is called with a user pointer and the user pointer comes
from these functions:
- return value from the getpwent() function (Unix).
- return value from the getpwnam() function (Unix).
- return value from the NetUserEnum() function (MS Windows).
For the first 2 callers, the man page for those functions directly says,
one should not free the returned pointer (since it comes from static
memory).
For the third caller (on MS Windows), the returned buffer is already
freed directly after calling the add_user() function in
NetApiBufferFree(), so this would lead to a double free().
This all indicates, the user ptr is wrongly freed in the add_user()
function and the intention was to free the user_copy pointer instead in
case of an error.
So let's just use that now.
fixes: #14250
closes: #14260
Signed-off-by: Christian Brabandt <cb@256bit.org>
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Sun, 24 Mar 2024 10:00:09 +0100 |
| parents | cce6b834635c |
| children | b39982468366 |
line wrap: on
line source
/* typval.c */ typval_T *alloc_tv(void); typval_T *alloc_string_tv(char_u *s); void free_tv(typval_T *varp); void clear_tv(typval_T *varp); void init_tv(typval_T *varp); varnumber_T tv_get_number(typval_T *varp); varnumber_T tv_to_number(typval_T *varp); varnumber_T tv_get_number_chk(typval_T *varp, int *denote); varnumber_T tv_get_bool(typval_T *varp); varnumber_T tv_get_bool_chk(typval_T *varp, int *denote); float_T tv_get_float(typval_T *varp); int check_for_unknown_arg(typval_T *args, int idx); int check_for_string_arg(typval_T *args, int idx); int check_for_nonempty_string_arg(typval_T *args, int idx); int check_for_opt_string_arg(typval_T *args, int idx); int check_for_number_arg(typval_T *args, int idx); int check_for_opt_number_arg(typval_T *args, int idx); int check_for_float_or_nr_arg(typval_T *args, int idx); int check_for_bool_arg(typval_T *args, int idx); int check_for_opt_bool_arg(typval_T *args, int idx); int check_for_blob_arg(typval_T *args, int idx); int check_for_list_arg(typval_T *args, int idx); int check_for_nonnull_list_arg(typval_T *args, int idx); int check_for_opt_list_arg(typval_T *args, int idx); int check_for_dict_arg(typval_T *args, int idx); int check_for_nonnull_dict_arg(typval_T *args, int idx); int check_for_opt_dict_arg(typval_T *args, int idx); int check_for_opt_nonnull_dict_arg(typval_T *args, int idx); int check_for_chan_or_job_arg(typval_T *args, int idx); int check_for_opt_chan_or_job_arg(typval_T *args, int idx); int check_for_job_arg(typval_T *args, int idx); int check_for_opt_job_arg(typval_T *args, int idx); int check_for_string_or_number_arg(typval_T *args, int idx); int check_for_opt_string_or_number_arg(typval_T *args, int idx); int check_for_buffer_arg(typval_T *args, int idx); int check_for_opt_buffer_arg(typval_T *args, int idx); int check_for_lnum_arg(typval_T *args, int idx); int check_for_opt_lnum_arg(typval_T *args, int idx); int check_for_string_or_blob_arg(typval_T *args, int idx); int check_for_string_or_list_arg(typval_T *args, int idx); int check_for_string_or_list_or_blob_arg(typval_T *args, int idx); int check_for_opt_string_or_list_arg(typval_T *args, int idx); int check_for_string_or_dict_arg(typval_T *args, int idx); int check_for_string_or_number_or_list_arg(typval_T *args, int idx); int check_for_opt_string_or_number_or_list_arg(typval_T *args, int idx); int check_for_string_or_number_or_list_or_blob_arg(typval_T *args, int idx); int check_for_string_or_list_or_dict_arg(typval_T *args, int idx); int check_for_string_or_func_arg(typval_T *args, int idx); int check_for_list_or_blob_arg(typval_T *args, int idx); int check_for_list_or_dict_arg(typval_T *args, int idx); int check_for_list_or_dict_or_blob_arg(typval_T *args, int idx); int check_for_list_or_dict_or_blob_or_string_arg(typval_T *args, int idx); int check_for_opt_buffer_or_dict_arg(typval_T *args, int idx); int check_for_object_arg(typval_T *args, int idx); int tv_class_alias(typval_T *tv); int check_for_class_or_typealias_args(typval_T *args, int idx); char_u *tv_get_string(typval_T *varp); char_u *tv_get_string_strict(typval_T *varp); char_u *tv_get_string_buf(typval_T *varp, char_u *buf); char_u *tv_get_string_chk(typval_T *varp); char_u *tv_get_string_buf_chk(typval_T *varp, char_u *buf); char_u *tv_get_string_buf_chk_strict(typval_T *varp, char_u *buf, int strict); char_u *tv_stringify(typval_T *varp, char_u *buf); int tv_check_lock(typval_T *tv, char_u *name, int use_gettext); void copy_tv(typval_T *from, typval_T *to); int typval_compare(typval_T *tv1, typval_T *tv2, exprtype_T type, int ic); int typval_compare_list(typval_T *tv1, typval_T *tv2, exprtype_T type, int ic, int *res); int typval_compare_null(typval_T *tv1, typval_T *tv2); int typval_compare_blob(typval_T *tv1, typval_T *tv2, exprtype_T type, int *res); int typval_compare_class(typval_T *tv1, typval_T *tv2, exprtype_T type, int ic, int *res); int typval_compare_object(typval_T *tv1, typval_T *tv2, exprtype_T type, int ic, int *res); int typval_compare_dict(typval_T *tv1, typval_T *tv2, exprtype_T type, int ic, int *res); int typval_compare_func(typval_T *tv1, typval_T *tv2, exprtype_T type, int ic, int *res); int typval_compare_string(typval_T *tv1, typval_T *tv2, exprtype_T type, int ic, int *res); char_u *typval_tostring(typval_T *arg, int quotes); int tv_islocked(typval_T *tv); int tv_equal(typval_T *tv1, typval_T *tv2, int ic, int recursive); int eval_option(char_u **arg, typval_T *rettv, int evaluate); int eval_number(char_u **arg, typval_T *rettv, int evaluate, int want_string); int eval_string(char_u **arg, typval_T *rettv, int evaluate, int interpolate); int eval_lit_string(char_u **arg, typval_T *rettv, int evaluate, int interpolate); int eval_interp_string(char_u **arg, typval_T *rettv, int evaluate); char_u *tv2string(typval_T *tv, char_u **tofree, char_u *numbuf, int copyID); int eval_env_var(char_u **arg, typval_T *rettv, int evaluate); linenr_T tv_get_lnum(typval_T *argvars); linenr_T tv_get_lnum_buf(typval_T *argvars, buf_T *buf); buf_T *tv_get_buf(typval_T *tv, int curtab_only); buf_T *tv_get_buf_from_arg(typval_T *tv); /* vim: set ft=c : */