PATCH 2/5: Fix use-after-free when handling TRAPEXIT

Mikael Magnusson <[email protected]>
Newsgroups gmane.comp.shells.zsh.devel
Message-ID <[email protected]>
Valgrind complained:
==23555==    by 0x4AB280: dupstring (string.c:39)
==23555==    by 0x44E3FE: getshfuncfile (hashtable.c:1064)
==23555==    by 0x43FC97: doshfunc (exec.c:6023)
==23555==    by 0x43EC26: execshfunc (exec.c:5584)
==23555==    by 0x43ADE8: execcmd_exec (exec.c:4108)
==23555==    by 0x434ADC: execpline2 (exec.c:2014)
==23555==    by 0x43371F: execpline (exec.c:1739)
==23555==    by 0x43299A: execlist (exec.c:1492)
==23555==    by 0x432000: execode (exec.c:1273)
==23555==    by 0x428D08: eval (builtin.c:6221)
==23555==    by 0x429452: bin_eval (builtin.c:6407)
==23555==  Address 0x7aade80 is 0 bytes inside a block of size 11 free'd
==23555==    at 0x483C17B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==23555==    by 0x474E5C: zsfree (mem.c:1878)
==23555==    by 0x44F0FC: dircache_set (hashtable.c:1545)
==23555==    by 0x44DDAE: freeshfuncnode (hashtable.c:897)
==23555==    by 0x4A8DA4: unsettrap (signals.c:766)
==23555==    by 0x4A94B6: starttrapscope (signals.c:868)
==23555==    by 0x43F75F: doshfunc (exec.c:5902)
==23555==    by 0x43EC26: execshfunc (exec.c:5584)
==23555==    by 0x43ADE8: execcmd_exec (exec.c:4108)
==23555==    by 0x434ADC: execpline2 (exec.c:2014)
==23555==    by 0x43371F: execpline (exec.c:1739)
==23555==    by 0x43299A: execlist (exec.c:1492)
==23555==  Block was alloc'd at
==23555==    at 0x48397B5: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==23555==    by 0x474907: zalloc (mem.c:966)
==23555==    by 0x4AB335: ztrdup (string.c:68)
==23555==    by 0x43E3A1: execfuncdef (exec.c:5387)
==23555==    by 0x432318: execsimple (exec.c:1329)
==23555==    by 0x4327D0: execlist (exec.c:1459)
==23555==    by 0x432000: execode (exec.c:1273)
==23555==    by 0x428D08: eval (builtin.c:6221)
==23555==    by 0x429452: bin_eval (builtin.c:6407)
==23555==    by 0x411C8E: execbuiltin (builtin.c:506)
==23555==    by 0x43B51C: execcmd_exec (exec.c:4237)
==23555==    by 0x434ADC: execpline2 (exec.c:2014)
---
 Src/exec.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Src/exec.c b/Src/exec.c
index 47d70b5a96..170c4734c2 100644
--- a/Src/exec.c
+++ b/Src/exec.c
@@ -5891,6 +5891,7 @@ doshfunc(Shfunc shfunc, LinkList doshargs, int noreturnval)
 	    Shfunc shcopy = (Shfunc)zhalloc(sizeof(struct shfunc));
 	    memcpy(shcopy, shfunc, sizeof(struct shfunc));
 	    shcopy->node.nam = dupstring(shfunc->node.nam);
+	    shcopy->filename = dupstring(shfunc->filename);
 	    shfunc = shcopy;
 	    name = shfunc->node.nam;
 	}
-- 
2.38.1
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.