* libc/posix/closedir.c: Fix use after free.

	Remove useless test dd_fd != -1
	* libc/posix/readdir.c: Remove useless test dd_fd == -1
	* libc/posix/readdir_r.c: Ditto.

diff --git a/newlib/ChangeLog b/newlib/ChangeLog
index dc1b1e7fb9275e8cb651fb561c0a84aaf0d43367..16e648df332cdb2c2cf57d3d15a7bb9ad21b3bee 100644 (file)
--- a/newlib/ChangeLog
+++ b/newlib/ChangeLog
@@ -1,3 +1,10 @@
+2013-11-19  Terraneo Federico  <fede.tft@hotmail.it>
+
+       * libc/posix/closedir.c: Fix use after free.
+       Remove useless test dd_fd != -1
+       * libc/posix/readdir.c: Remove useless test dd_fd == -1
+       * libc/posix/readdir_r.c: Ditto.
+
 2013-11-18  Sahil Patnayakuni  <sahilp@oarcorp.com>
 
        * libc/include/stdio.h, libc/machine/powerpc/vfscanf.c,

diff --git a/newlib/libc/posix/closedir.c b/newlib/libc/posix/closedir.c
index 634f5ad1213417e53070dc593bd44f68766c2f47..7801da0437939e74dd385baf757b19d642a2b9d2 100644 (file)
--- a/newlib/libc/posix/closedir.c
+++ b/newlib/libc/posix/closedir.c
@@ -52,25 +52,19 @@ int
 _DEFUN(closedir, (dirp),
        register DIR *dirp)
 {
-       int fd, rc;
+       int rc;
 
 #ifdef HAVE_DD_LOCK
        __lock_acquire_recursive(dirp->dd_lock);
 #endif
-       rc = 0;
-       fd = dirp->dd_fd;
-       if (fd != -1) {
-               dirp->dd_fd = -1;
-               dirp->dd_loc = 0;
-               (void)free((void *)dirp->dd_buf);
-               (void)free((void *)dirp);
-               rc = close(fd);
-               _cleanupdir(dirp);
-       }
+       rc = close(dirp->dd_fd);
+       _cleanupdir(dirp);
+       free((void *)dirp->dd_buf);
 #ifdef HAVE_DD_LOCK
        __lock_release_recursive(dirp->dd_lock);
        __lock_close_recursive(dirp->dd_lock);
 #endif
+       free((void *)dirp);
        return rc;
 }
 

diff --git a/newlib/libc/posix/readdir.c b/newlib/libc/posix/readdir.c
index d3187e6035170906d4709ac8767e904c97d70a5e..3e620e328aa8f37230c6ad152946653899667bb6 100644 (file)
--- a/newlib/libc/posix/readdir.c
+++ b/newlib/libc/posix/readdir.c
@@ -53,9 +53,6 @@ _DEFUN(readdir, (dirp),
 #ifdef HAVE_DD_LOCK
   __lock_acquire_recursive(dirp->dd_lock);
 #endif
-
-  if (dirp->dd_fd == -1)
-    return NULL;
  
   for (;;) {
     if (dirp->dd_loc == 0) {

diff --git a/newlib/libc/posix/readdir_r.c b/newlib/libc/posix/readdir_r.c
index eafbeca6a4219c46344997fa996ba4dd77c1ae6f..1d526e3095f6300d3c614ed906cb8a075473ff43 100644 (file)
--- a/newlib/libc/posix/readdir_r.c
+++ b/newlib/libc/posix/readdir_r.c
@@ -60,11 +60,6 @@ struct dirent *tmpdp;
 #ifdef HAVE_DD_LOCK
   __lock_acquire_recursive(dirp->dd_lock);
 #endif
-
-  if (dirp->dd_fd == -1) {
-    *dpp = NULL;
-    return errno = EBADF;
-  }
  
   for (;;) {
     if (dirp->dd_loc == 0) {