[PATCH] yat2m: don't dereference pointer to freed memory

Jim Meyering jim at meyering.net
Sat Jan 14 22:36:08 CET 2012


Here's an untested patch.
Coverity spotted the use-after-free.

>From b99a8f0d77509d9f77aa5e42890e927abbbafae0 Mon Sep 17 00:00:00 2001
From: Jim Meyering <meyering at redhat.com>
Date: Sat, 14 Jan 2012 22:34:58 +0100
Subject: [PATCH] yat2m: don't dereference pointer to freed memory

* doc/yat2m.c (top_parse_file): Correct macrolist-freeing loop.
---
 doc/yat2m.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/yat2m.c b/doc/yat2m.c
index aaa7ea6..a22176c 100644
--- a/doc/yat2m.c
+++ b/doc/yat2m.c
@@ -1203,10 +1203,10 @@ top_parse_file (const char *fname, FILE *fp)
                                  if not in a section.  */
   while (macrolist)
     {
-      macro_t m = macrolist->next;
-      free (m->value);
-      free (m);
-      macrolist = m;
+      macro_t next = macrolist->next;
+      free (macrolist->value);
+      free (macrolist);
+      macrolist = next;
     }

   parse_file (fname, fp, &section_name, 0);
--
1.7.9.rc1.2.gccfe4



More information about the Gnupg-devel mailing list