Invalid access to free'd memory after DeleteLinesMatching

Enrico Scholz <[email protected]>
Newsgroups gmane.comp.sysutils.cfengine.bugs
Message-ID <[email protected]>
Hi,

cfengine-2.2.8 segfaults on rules like

----
control:
        actionsequence = ( editfiles )

editfiles:
        { /tmp/foo
                DeleteLinesMatching "foo"
                LocateLineMatching "foo"
        }
----

when '/tmp/foo' contains 'foo' string.  Analyzing this with 'valgrind'
gives

==4784== Invalid read of size 8
==4784==    at 0x423348: LocateItemMatchingRegExp (item-ext.c:394)
==4784==    by 0x4357D9: DoEditFile (edittools.c:577)
==4784==    by 0x436ACE: WrapDoEditFile (edittools.c:118)
==4784==    by 0x40B393: EditFiles (do.c:2382)
==4784==    by 0x405884: DoTree (cfagent.c:1334)
==4784==    by 0x407ECF: main (cfagent.c:241)
==4784==  Address 0x7070C08 is 8 bytes inside a block of size 72 free'd
==4784==    at 0x4C1F41E: free (vg_replace_malloc.c:233)
==4784==    by 0x423BAF: DeleteItemGeneral (item-ext.c:708)
==4784==    by 0x434B9B: DoEditFile (edittools.c:343)
==4784==    by 0x436ACE: WrapDoEditFile (edittools.c:118)
==4784==    by 0x40B393: EditFiles (do.c:2382)
==4784==    by 0x405884: DoTree (cfagent.c:1334)
==4784==    by 0x407ECF: main (cfagent.c:241)



--> LocateItemMatchingRegExp() is called with a CURRENTLINEPTR which
points to memory free'd by DeleteItemGeneral




Enrioc
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.