Skip to content

Commit 52cf0a1

Browse files
Rob SandersDavid Parrish
authored andcommitted
Fix possible double free in cli_command_name
Coverity indicates a possible double free in cli_command_name. This appears to be due to name being set to cli->commandname, and then if this is not null name is freed, but cli->commandname is untouched. If this routine exits early (for example, the calloc fails), then cli->commandname is now pointing to a freed memory block. Fixed by ensuring that cli->commandname is freed and set to null if not null already before assigning cli->commandname to name.
1 parent 51f018c commit 52cf0a1

1 file changed

Lines changed: 9 additions & 2 deletions

File tree

libcli.c

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -163,12 +163,19 @@ static ssize_t _write(int fd, const void *buf, size_t count)
163163
}
164164
return written;
165165
}
166+
166167
char *cli_command_name(struct cli_def *cli, struct cli_command *command)
167168
{
168-
char *name = cli->commandname;
169+
char *name;
169170
char *o;
170171

171-
if (name) free(name);
172+
if (cli->commandname)
173+
{
174+
free(cli->commandname);
175+
cli->commandname = NULL;
176+
}
177+
name = cli->commandname;
178+
172179
if (!(name = calloc(1, 1)))
173180
return NULL;
174181

0 commit comments

Comments
 (0)