• Alan Coopersmith's avatar
    ximcp: Prevent memory leak & double free if multiple %L in string · 290f94ae
    Alan Coopersmith authored
    In the highly unlikely event that TransFileName was passed a path
    containing multiple %L entries, for each entry it would call
    _XlcFileName, leaking the previous results, and then for each entry it
    would copy from that pointer and free it, resulting in invalid pointers
    & possible double frees for each use after the first one freed it.
    
    Error: Use after free (CWE 416)
       Use after free of pointer 'lcCompose'
            at line 358 of nx-X11/lib/X11/imLcPrs.c in function 'TransFileName'.
              Previously freed at line 360 with free.
    Error: Use after free (CWE 416)
       Use after free of pointer 'lcCompose'
            at line 359 of nx-X11/lib/X11/imLcPrs.c in function 'TransFileName'.
              Previously freed at line 360 with free.
    Error: Double free (CWE 415)
       Double free of pointer 'lcCompose'
            at line 360 of nx-X11/lib/X11/imLcPrs.c in function 'TransFileName'.
              Previously freed at line 360 with free.
    
    [ This bug was found by the Parfait 0.3.6 bug checking tool.
      For more information see http://labs.oracle.com/projects/parfait/ ]
    Signed-off-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com>
    (cherry picked from commit 6ac417cea1136a3617f5e40f4b106aaa3f48d6c2)
    Backported-to-NX-by: 's avatarUlrich Sibiller <uli42@gmx.de>
    290f94ae
imLcPrs.c 15.7 KB