Skip to content

Commit

Permalink
Fix double free.
Browse files Browse the repository at this point in the history
When a command starting with an asterisk was encountered, ModuleConfig
was called, which calls AddToModList which frees its argument
sometimes. Then __execute_function tries to free the same pointer
again. This commit fixes this by only freeing rline in AddToModList if
it points at xasprintf'd memory, as freeing the memory from xasprintf
won't invalidate expaction.

Fixes #425.
  • Loading branch information
Quipyowert2 authored and ThomasAdam committed Feb 8, 2021
1 parent 29a2bf5 commit f9d3cc9
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion fvwm/modconf.c
100644 → 100755
Original file line number Diff line number Diff line change
Expand Up @@ -154,7 +154,10 @@ static struct moduleInfoList *AddToModList(char *tline)
this->data = expand_vars(rline, NULL, False, True, NULL, exc);
strcpy(this->data, rline);
exc_destroy_context(exc);
free(rline);
/* Free rline only if it is xasprintf'd memory (not pointing at tline
* anymore). If we free our tline argument it causes a crash in __execute_function. */
if (rline != tline)
free(rline);

this->next = NULL;
if(prev == NULL)
Expand Down

0 comments on commit f9d3cc9

Please sign in to comment.