summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--ChangeLog2
-rw-r--r--doc/TODO.0122
-rw-r--r--src/common/util.c6
3 files changed, 6 insertions, 4 deletions
diff --git a/ChangeLog b/ChangeLog
index e2ba35257e..19e86a287e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -10,6 +10,8 @@ Changes in version 0.1.2.18 - 2007-??-??
- When generating information telling us how to extend to a given
router, do not try to include the nickname if it is absent. (Resolves
bug 467.)
+ - Fix a user-triggerable segfault in expand_filename(). (There isn't
+ a way to trigger this remotely.)
o Minor bugfixes (controller):
- When sending a status event to the controller telling it that an
diff --git a/doc/TODO.012 b/doc/TODO.012
index 412acc46eb..9d8121c6ee 100644
--- a/doc/TODO.012
+++ b/doc/TODO.012
@@ -25,4 +25,4 @@ Backport for 0.1.2.x once better tested:
- r11499, r11500, r11501: hidserv hexdigests rather than nicknames
- r11548, the osx /tmp fix
o r11293: Bulletproof code to generate extend info.
- - r11332: Fix user-triggerable segfault in expand_filename("~") \ No newline at end of file
+ o r11332: Fix user-triggerable segfault in expand_filename("~") \ No newline at end of file
diff --git a/src/common/util.c b/src/common/util.c
index 3ab72a5745..04b59782eb 100644
--- a/src/common/util.c
+++ b/src/common/util.c
@@ -1555,7 +1555,7 @@ expand_filename(const char *filename)
return NULL;
}
home = tor_strdup(home);
- rest = strlen(filename)>=2?(filename+2):NULL;
+ rest = strlen(filename)>=2?(filename+2):"";
} else {
#ifdef HAVE_PWD_H
char *username, *slash;
@@ -1570,7 +1570,7 @@ expand_filename(const char *filename)
return NULL;
}
tor_free(username);
- rest = slash ? (slash+1) : NULL;
+ rest = slash ? (slash+1) : "";
#else
log_warn(LD_CONFIG, "Couldn't expend homedir on system without pwd.h");
return tor_strdup(filename);
@@ -1585,7 +1585,7 @@ expand_filename(const char *filename)
* Round up to 16 in case we can't do math. */
len = strlen(home)+strlen(rest)+16;
result = tor_malloc(len);
- tor_snprintf(result,len,"%s/%s",home,rest?rest:"");
+ tor_snprintf(result,len,"%s/%s",home,rest);
tor_free(home);
return result;
} else {