From cffd3107449f81026fb4037607b614c6dc4e4560 Mon Sep 17 00:00:00 2001 From: Steffen Jaeckel Date: Tue, 18 Mar 2025 10:28:05 +0100 Subject: [PATCH] Fix shadowing of `msg` resulting in invalid free. ``` ==500714== Invalid free() / delete / delete[] / realloc() ==500714== at 0x484A78B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==500714== by 0x5BDCD58: g_free (in /usr/lib64/libglib-2.0.so.0.8200.2) ==500714== by 0x49016B: http_file_put (http_upload.c:175) ==500714== by 0x5F613B1: start_thread (in /usr/lib64/libc.so.6) ==500714== by 0x5FE63D3: clone (in /usr/lib64/libc.so.6) ==500714== Address 0x86f6510 is 0 bytes inside a block of size 53 free'd ==500714== at 0x484A78B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==500714== by 0x5BDCD58: g_free (in /usr/lib64/libglib-2.0.so.0.8200.2) ==500714== by 0x490299: http_file_put (http_upload.c:324) ==500714== by 0x5F613B1: start_thread (in /usr/lib64/libc.so.6) ==500714== by 0x5FE63D3: clone (in /usr/lib64/libc.so.6) ==500714== Block was alloc'd at ==500714== at 0x48477C4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==500714== by 0x5F548A7: __vasprintf_internal (in /usr/lib64/libc.so.6) ==500714== by 0x5C2DD1D: g_vasprintf (in /usr/lib64/libglib-2.0.so.0.8200.2) ==500714== by 0x5BF8D97: g_strdup_vprintf (in /usr/lib64/libglib-2.0.so.0.8200.2) ==500714== by 0x5BF8E58: g_strdup_printf (in /usr/lib64/libglib-2.0.so.0.8200.2) ==500714== by 0x490264: http_file_put (http_upload.c:318) ==500714== by 0x5F613B1: start_thread (in /usr/lib64/libc.so.6) ==500714== by 0x5FE63D3: clone (in /usr/lib64/libc.so.6) ``` Signed-off-by: Steffen Jaeckel --- src/tools/http_upload.c | 37 +++++++++++++++++-------------------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/src/tools/http_upload.c b/src/tools/http_upload.c index 2d051023..a1c31b27 100644 --- a/src/tools/http_upload.c +++ b/src/tools/http_upload.c @@ -298,39 +298,36 @@ http_file_put(void* userdata) pthread_mutex_lock(&lock); if (err) { - gchar* msg; + auto_gchar gchar* err_msg = NULL; if (upload->cancel) { - msg = g_strdup_printf("Uploading '%s' failed: Upload was canceled", upload->filename); - if (!msg) { - msg = g_strdup(FALLBACK_MSG); + err_msg = g_strdup_printf("Uploading '%s' failed: Upload was canceled", upload->filename); + if (!err_msg) { + err_msg = g_strdup(FALLBACK_MSG); } } else { - msg = g_strdup_printf("Uploading '%s' failed: %s", upload->filename, err); - if (!msg) { - msg = g_strdup(FALLBACK_MSG); + err_msg = g_strdup_printf("Uploading '%s' failed: %s", upload->filename, err); + if (!err_msg) { + err_msg = g_strdup(FALLBACK_MSG); } - win_update_entry_message(upload->window, upload->put_url, msg); + win_update_entry_message(upload->window, upload->put_url, err_msg); } - cons_show_error(msg); - g_free(msg); + cons_show_error(err_msg); } else { if (!upload->cancel) { - msg = g_strdup_printf("Uploading '%s': 100%%", upload->filename); - if (!msg) { - msg = g_strdup(FALLBACK_MSG); + auto_gchar gchar* status_msg = g_strdup_printf("Uploading '%s': 100%%", upload->filename); + if (!status_msg) { + status_msg = g_strdup(FALLBACK_MSG); } - win_update_entry_message(upload->window, upload->put_url, msg); + win_update_entry_message(upload->window, upload->put_url, status_msg); win_mark_received(upload->window, upload->put_url); - g_free(msg); char* url = NULL; if (format_alt_url(upload->get_url, upload->alt_scheme, upload->alt_fragment, &url) != 0) { - gchar* msg = g_strdup_printf("Uploading '%s' failed: Bad URL ('%s')", upload->filename, upload->get_url); - if (!msg) { - msg = g_strdup(FALLBACK_MSG); + auto_gchar gchar* fail_msg = g_strdup_printf("Uploading '%s' failed: Bad URL ('%s')", upload->filename, upload->get_url); + if (!fail_msg) { + fail_msg = g_strdup(FALLBACK_MSG); } - cons_show_error(msg); - g_free(msg); + cons_show_error(fail_msg); } else { switch (upload->window->type) { case WIN_CHAT: