projects
/
project
/
uci.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
uci: fix a potential use-after-free in uci_set()
[project/uci.git]
/
file.c
diff --git
a/file.c
b/file.c
index
7e1e4e6
..
9856369
100644
(file)
--- a/
file.c
+++ b/
file.c
@@
-70,8
+70,6
@@
__private void uci_getln(struct uci_context *ctx, int offset)
pctx->bufsz *= 2;
pctx->buf = uci_realloc(ctx, pctx->buf, pctx->bufsz);
pctx->bufsz *= 2;
pctx->buf = uci_realloc(ctx, pctx->buf, pctx->bufsz);
- if (!pctx->buf)
- UCI_THROW(ctx, UCI_ERR_MEM);
} while (1);
}
} while (1);
}
@@
-410,7
+408,6
@@
static void uci_parse_config(struct uci_context *ctx)
char *name;
char *type;
char *name;
char *type;
- uci_fixup_section(ctx, ctx->pctx->section);
if (!ctx->pctx->package) {
if (!ctx->pctx->name)
uci_parse_error(ctx, "attempting to import a file without a package name");
if (!ctx->pctx->package) {
if (!ctx->pctx->name)
uci_parse_error(ctx, "attempting to import a file without a package name");
@@
-691,7
+688,6
@@
error:
UCI_THROW(ctx, ctx->err);
}
UCI_THROW(ctx, ctx->err);
}
- uci_fixup_section(ctx, ctx->pctx->section);
if (!pctx->package && name)
uci_switch_config(ctx);
if (package)
if (!pctx->package && name)
uci_switch_config(ctx);
if (package)
@@
-835,7
+831,7
@@
static char **uci_list_config_files(struct uci_context *ctx)
{
char **configs;
glob_t globbuf;
{
char **configs;
glob_t globbuf;
- int size, i;
+ int size, i
, j, skipped
;
char *buf;
char *dir;
char *buf;
char *dir;
@@
-847,18
+843,22
@@
static char **uci_list_config_files(struct uci_context *ctx)
}
size = sizeof(char *) * (globbuf.gl_pathc + 1);
}
size = sizeof(char *) * (globbuf.gl_pathc + 1);
+ skipped = 0;
for(i = 0; i < globbuf.gl_pathc; i++) {
char *p;
p = get_filename(globbuf.gl_pathv[i]);
for(i = 0; i < globbuf.gl_pathc; i++) {
char *p;
p = get_filename(globbuf.gl_pathv[i]);
- if (!p)
+ if (!p) {
+ skipped++;
continue;
continue;
+ }
size += strlen(p) + 1;
}
size += strlen(p) + 1;
}
- configs = uci_malloc(ctx, size);
- buf = (char *) &configs[globbuf.gl_pathc + 1];
+ configs = uci_malloc(ctx, size - skipped);
+ buf = (char *) &configs[globbuf.gl_pathc + 1 - skipped];
+ j = 0;
for(i = 0; i < globbuf.gl_pathc; i++) {
char *p;
for(i = 0; i < globbuf.gl_pathc; i++) {
char *p;
@@
-869,7
+869,7
@@
static char **uci_list_config_files(struct uci_context *ctx)
if (!uci_validate_package(p))
continue;
if (!uci_validate_package(p))
continue;
- configs[
i
] = buf;
+ configs[
j++
] = buf;
strcpy(buf, p);
buf += strlen(buf) + 1;
}
strcpy(buf, p);
buf += strlen(buf) + 1;
}