uci: fix a potential use-after-free in uci_set()

[project/uci.git] / file.c

diff --git a/file.c b/file.c
index 7e1e4e6..9856369 100644 (file)
--- a/file.c
+++ b/file.c
@@ -70,8 +70,6 @@ __private void uci_getln(struct uci_context *ctx, int offset)
 
                pctx->bufsz *= 2;
                pctx->buf = uci_realloc(ctx, pctx->buf, pctx->bufsz);
-               if (!pctx->buf)
-                       UCI_THROW(ctx, UCI_ERR_MEM);
        } while (1);
 }
 
@@ -410,7 +408,6 @@ static void uci_parse_config(struct uci_context *ctx)
        char *name;
        char *type;
 
-       uci_fixup_section(ctx, ctx->pctx->section);
        if (!ctx->pctx->package) {
                if (!ctx->pctx->name)
                        uci_parse_error(ctx, "attempting to import a file without a package name");
@@ -691,7 +688,6 @@ error:
                        UCI_THROW(ctx, ctx->err);
        }
 
-       uci_fixup_section(ctx, ctx->pctx->section);
        if (!pctx->package && name)
                uci_switch_config(ctx);
        if (package)
@@ -835,7 +831,7 @@ static char **uci_list_config_files(struct uci_context *ctx)
 {
        char **configs;
        glob_t globbuf;
-       int size, i;
+       int size, i, j, skipped;
        char *buf;
        char *dir;
 
@@ -847,18 +843,22 @@ static char **uci_list_config_files(struct uci_context *ctx)
        }
 
        size = sizeof(char *) * (globbuf.gl_pathc + 1);
+       skipped = 0;
        for(i = 0; i < globbuf.gl_pathc; i++) {
                char *p;
 
                p = get_filename(globbuf.gl_pathv[i]);
-               if (!p)
+               if (!p) {
+                       skipped++;
                        continue;
+               }
 
                size += strlen(p) + 1;
        }
 
-       configs = uci_malloc(ctx, size);
-       buf = (char *) &configs[globbuf.gl_pathc + 1];
+       configs = uci_malloc(ctx, size - skipped);
+       buf = (char *) &configs[globbuf.gl_pathc + 1 - skipped];
+       j = 0;
        for(i = 0; i < globbuf.gl_pathc; i++) {
                char *p;
 
@@ -869,7 +869,7 @@ static char **uci_list_config_files(struct uci_context *ctx)
                if (!uci_validate_package(p))
                        continue;
 
-               configs[i] = buf;
+               configs[j++] = buf;
                strcpy(buf, p);
                buf += strlen(buf) + 1;
        }