devs/profanity
2
0
Fork 0
mirror of https://git.jabber.space/devs/cproof.git synced 2026-07-18 06:16:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix shadowing of msg resulting in invalid free.

Browse Source 
```
==500714== Invalid free() / delete / delete[] / realloc()
==500714==    at 0x484A78B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==500714==    by 0x5BDCD58: g_free (in /usr/lib64/libglib-2.0.so.0.8200.2)
==500714==    by 0x49016B: http_file_put (http_upload.c:175)
==500714==    by 0x5F613B1: start_thread (in /usr/lib64/libc.so.6)
==500714==    by 0x5FE63D3: clone (in /usr/lib64/libc.so.6)
==500714==  Address 0x86f6510 is 0 bytes inside a block of size 53 free'd
==500714==    at 0x484A78B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==500714==    by 0x5BDCD58: g_free (in /usr/lib64/libglib-2.0.so.0.8200.2)
==500714==    by 0x490299: http_file_put (http_upload.c:324)
==500714==    by 0x5F613B1: start_thread (in /usr/lib64/libc.so.6)
==500714==    by 0x5FE63D3: clone (in /usr/lib64/libc.so.6)
==500714==  Block was alloc'd at
==500714==    at 0x48477C4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==500714==    by 0x5F548A7: __vasprintf_internal (in /usr/lib64/libc.so.6)
==500714==    by 0x5C2DD1D: g_vasprintf (in /usr/lib64/libglib-2.0.so.0.8200.2)
==500714==    by 0x5BF8D97: g_strdup_vprintf (in /usr/lib64/libglib-2.0.so.0.8200.2)
==500714==    by 0x5BF8E58: g_strdup_printf (in /usr/lib64/libglib-2.0.so.0.8200.2)
==500714==    by 0x490264: http_file_put (http_upload.c:318)
==500714==    by 0x5F613B1: start_thread (in /usr/lib64/libc.so.6)
==500714==    by 0x5FE63D3: clone (in /usr/lib64/libc.so.6)
```

Signed-off-by: Steffen Jaeckel <s@jaeckel.eu>
This commit is contained in:
Steffen Jaeckel
2025-03-18 10:28:05 +01:00
parent 59aa9d64df
commit cffd310744
1 changed files with 17 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
src/tools/http_upload.c
View File

@@ -298,39 +298,36 @@ http_file_put(void* userdata)
pthread_mutex_lock(&lock);
if (err) {
gchar* msg;
auto_gchar gchar* err_msg = NULL;
if (upload->cancel) {
msg = g_strdup_printf("Uploading '%s' failed: Upload was canceled", upload->filename);
if (!msg) {
msg = g_strdup(FALLBACK_MSG);
err_msg = g_strdup_printf("Uploading '%s' failed: Upload was canceled", upload->filename);
if (!err_msg) {
err_msg = g_strdup(FALLBACK_MSG);
}
} else {
msg = g_strdup_printf("Uploading '%s' failed: %s", upload->filename, err);
if (!msg) {
msg = g_strdup(FALLBACK_MSG);
err_msg = g_strdup_printf("Uploading '%s' failed: %s", upload->filename, err);
if (!err_msg) {
err_msg = g_strdup(FALLBACK_MSG);
}
win_update_entry_message(upload->window, upload->put_url, msg);
win_update_entry_message(upload->window, upload->put_url, err_msg);
}
cons_show_error(msg);
g_free(msg);
cons_show_error(err_msg);
} else {
if (!upload->cancel) {
msg = g_strdup_printf("Uploading '%s': 100%%", upload->filename);
if (!msg) {
msg = g_strdup(FALLBACK_MSG);
auto_gchar gchar* status_msg = g_strdup_printf("Uploading '%s': 100%%", upload->filename);
if (!status_msg) {
status_msg = g_strdup(FALLBACK_MSG);
}
win_update_entry_message(upload->window, upload->put_url, msg);
win_update_entry_message(upload->window, upload->put_url, status_msg);
win_mark_received(upload->window, upload->put_url);
g_free(msg);
char* url = NULL;
if (format_alt_url(upload->get_url, upload->alt_scheme, upload->alt_fragment, &url) != 0) {
gchar* msg = g_strdup_printf("Uploading '%s' failed: Bad URL ('%s')", upload->filename, upload->get_url);
if (!msg) {
msg = g_strdup(FALLBACK_MSG);
auto_gchar gchar* fail_msg = g_strdup_printf("Uploading '%s' failed: Bad URL ('%s')", upload->filename, upload->get_url);
if (!fail_msg) {
fail_msg = g_strdup(FALLBACK_MSG);
}
cons_show_error(msg);
g_free(msg);
cons_show_error(fail_msg);
} else {
switch (upload->window->type) {
case WIN_CHAT: