[Patch] fix use-after-free in dcigettext.c

Roland McGrath roland@hack.frob.com
Thu Jun 21 20:47:00 GMT 2012


While that fix looks like it can't be wrong, looking at the surrounding
code it looks like there's a better fix.  The old value is always available
in the new copy, i.e. NEWMEM->next.  But about 30 lines below, we have:

		  newmem->next = transmem_list;
		  transmem_list = newmem;

It popping the element off and then putting it back on is entirely redundant.
The addition is necessary in the malloc (not realloc) case.  But it could
just be done inside that case.


Thanks,
Roland



More information about the Libc-alpha mailing list