bug-glibc
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

minor ftw bug


From: Jim Meyering
Subject: minor ftw bug
Date: Fri, 28 Feb 2003 15:49:28 +0100

Without this fix, you can provoke a NULL-pointer dereference by
calling ftw/nftw with a maximum number of descriptors that is large
enough to make alloca return NULL.

2003-02-28  Jim Meyering  <address@hidden>

        * io/ftw.c (ftw_startup): Return -1 if alloca fails.
        Reuse previously-declared local, save_err, rather than shadowing it.

Index: ftw.c
===================================================================
RCS file: /cvs/glibc/libc/io/ftw.c,v
retrieving revision 1.42
diff -u -p -u -p -r1.42 ftw.c
--- ftw.c       8 Feb 2003 18:27:13 -0000       1.42
+++ ftw.c       28 Feb 2003 14:42:41 -0000
@@ -591,6 +591,8 @@ ftw_startup (const char *dir, int is_nft
   data.actdir = 0;
   data.dirstreams = (struct dir_data **) alloca (data.maxdir
                                                 * sizeof (struct dir_data *));
+  if (data.dirstreams == NULL)
+    return -1;
   memset (data.dirstreams, '\0', data.maxdir * sizeof (struct dir_data *));
 
   /* PATH_MAX is always defined when we get here.  */
@@ -703,7 +705,7 @@ ftw_startup (const char *dir, int is_nft
   /* Return to the start directory (if necessary).  */
   if (cwd != NULL)
     {
-      int save_err = errno;
+      save_err = errno;
       __chdir (cwd);
       free (cwd);
       __set_errno (save_err);




reply via email to

[Prev in Thread] Current Thread [Next in Thread]