[patch] buf freed twice in usr.bin/ftp/fetch.c

From: Brian Poole <raj(at)cerias.purdue.edu>
Date: Mon Jan 27 2003 - 21:08:41 EST

buf gets freed twice when using ftp to grab a file via http and you are unable to create the local file. Looks like this:

$ ftp http://ftp.cerias.purdue.edu/pub/ls-lR Trying 128.10.252.10...
Requesting http://ftp.cerias.purdue.edu/pub/ls-lR ftp: Can't open ls-lR: Permission denied ftp in free(): error: page is already free. Abort

The first free is on line 471, the second is on 556.

One fix is to move the first free down to a safe point, which I have done. Could also do what NetBSD does and set buf = NULL after freeing it (they use a macro FREEPTR in their ftp.) That of course would be a good bit more effort.

-b

Index: fetch.c

---

RCS file: /cvs/src/usr.bin/ftp/fetch.c,v retrieving revision 1.42
diff -u -r1.42 fetch.c

--- fetch.c	30 Dec 2002 23:04:42 -0000	1.42
+++ fetch.c	28 Jan 2003 01:36:47 -0000

@@ -468,7 +468,6 @@


 			return (rval);
 		}
 	}
-	free(buf);
 
 	/* Open the output file.  */
 	if (strcmp(savefile, "-") != 0) {


@@ -492,6 +491,8 @@


 	bytes = 0;
 	hashbytes = mark;
 	progressmeter(-1);
+
+	free(buf);
 
 	/* Finally, suck down the file. */
 	if ((buf = malloc(4096)) == NULL)

Received on Tue Jan 28 09:34:53 2003