diff options
| author | Nick Mathewson <nickm@torproject.org> | 2017-08-11 11:51:06 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2017-08-11 11:51:06 -0400 |
| commit | 4d5e8378be3848c07a9b1026924e879e5642903f (patch) | |
| tree | 9c771d9aceb59be6823ea510eb94befa544c6a44 | |
| parent | 47e7a167d23c6ba1492a4006f6275e34c6a57b14 (diff) | |
| parent | 72832086e2144158308b30133aa15b39f0d2eb5d (diff) | |
| download | tor-4d5e8378be3848c07a9b1026924e879e5642903f.tar.gz tor-4d5e8378be3848c07a9b1026924e879e5642903f.zip | |
Merge branch 'maint-0.3.1' into release-0.3.1
| -rw-r--r-- | changes/bug23155 | 4 | ||||
| -rw-r--r-- | src/common/confline.c | 16 |
2 files changed, 13 insertions, 7 deletions
diff --git a/changes/bug23155 b/changes/bug23155 new file mode 100644 index 0000000000..4c24ab136c --- /dev/null +++ b/changes/bug23155 @@ -0,0 +1,4 @@ + o Minor bugfixes (stability): + - Avoid crashing on double-free when unable to load or process + an included file. Fixes bug 23155; bugfix on 0.3.1.1-alpha. + Found with the clang static analyzer. diff --git a/src/common/confline.c b/src/common/confline.c index 691cbf8c6f..15fd96bf38 100644 --- a/src/common/confline.c +++ b/src/common/confline.c @@ -294,24 +294,26 @@ config_process_include(const char *path, int recursion_level, int extended, return -1; } - SMARTLIST_FOREACH_BEGIN(config_files, char *, config_file) { + int rv = -1; + SMARTLIST_FOREACH_BEGIN(config_files, const char *, config_file) { config_line_t *included_list = NULL; if (config_get_included_list(config_file, recursion_level, extended, &included_list, list_last) < 0) { - SMARTLIST_FOREACH(config_files, char *, f, tor_free(f)); - smartlist_free(config_files); - return -1; + goto done; } - tor_free(config_file); *next = included_list; if (*list_last) next = &(*list_last)->next; } SMARTLIST_FOREACH_END(config_file); - smartlist_free(config_files); *list = ret_list; - return 0; + rv = 0; + + done: + SMARTLIST_FOREACH(config_files, char *, f, tor_free(f)); + smartlist_free(config_files); + return rv; } /** |