1 |
commit: 167ded327a715f6378942f668f326ebc26f15d1a |
2 |
Author: Mike Frysinger <vapier <AT> gentoo <DOT> org> |
3 |
AuthorDate: Sun Sep 20 06:57:54 2015 +0000 |
4 |
Commit: Mike Frysinger <vapier <AT> gentoo <DOT> org> |
5 |
CommitDate: Sun Sep 20 06:57:54 2015 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/sandbox.git/commit/?id=167ded32 |
7 |
|
8 |
libsandbox: egetcwd: fix handling of NULL inputs |
9 |
|
10 |
We don't want to let the C library do the memory allocation for us when |
11 |
buf==NULL as it won't use our memory functions, so when we try to call |
12 |
our free on it, we get corruption. Handle the automatic allocation in |
13 |
the code directly. |
14 |
|
15 |
Signed-off-by: Mike Frysinger <vapier <AT> gentoo.org> |
16 |
|
17 |
libsandbox/libsandbox.c | 20 ++++++++++++++++---- |
18 |
1 file changed, 16 insertions(+), 4 deletions(-) |
19 |
|
20 |
diff --git a/libsandbox/libsandbox.c b/libsandbox/libsandbox.c |
21 |
index 4f4589f..3bd3794 100644 |
22 |
--- a/libsandbox/libsandbox.c |
23 |
+++ b/libsandbox/libsandbox.c |
24 |
@@ -306,7 +306,16 @@ static char *resolve_path(const char *path, int follow_link) |
25 |
char *egetcwd(char *buf, size_t size) |
26 |
{ |
27 |
struct stat st; |
28 |
- char *tmpbuf, *oldbuf = buf; |
29 |
+ char *tmpbuf; |
30 |
+ |
31 |
+ /* We can't let the C lib allocate memory for us since we have our |
32 |
+ * own local routines to handle things. |
33 |
+ */ |
34 |
+ bool allocated = (buf == NULL); |
35 |
+ if (allocated) { |
36 |
+ size = SB_PATH_MAX; |
37 |
+ buf = xmalloc(size); |
38 |
+ } |
39 |
|
40 |
/* If tracing a child, our cwd may not be the same as the child's */ |
41 |
if (trace_pid) { |
42 |
@@ -354,9 +363,9 @@ char *egetcwd(char *buf, size_t size) |
43 |
errno = ENAMETOOLONG; |
44 |
|
45 |
if (errno && errno != EACCES) { |
46 |
- /* If getcwd() allocated the buffer, free it. */ |
47 |
- if (NULL == oldbuf) |
48 |
- free(tmpbuf); |
49 |
+ /* If getcwd() allocated the buffer, free it. */ |
50 |
+ if (allocated) |
51 |
+ free(buf); |
52 |
|
53 |
/* Not sure if we should quit here, but I guess if |
54 |
* lstat() fails, getcwd could have messed up. Not |
55 |
@@ -368,6 +377,9 @@ char *egetcwd(char *buf, size_t size) |
56 |
|
57 |
restore_errno(); |
58 |
} else if (errno != 0) { |
59 |
+ /* If getcwd() allocated the buffer, free it. */ |
60 |
+ if (allocated) |
61 |
+ free(buf); |
62 |
|
63 |
/* Make sure we do not return garbage if the current libc or |
64 |
* kernel's getcwd() is buggy. |