Author: truckman
Date: Fri May 20 06:41:26 2016
New Revision: 300274
URL: https://svnweb.freebsd.org/changeset/base/300274
Log:
MFC r299591
Always return either a dynamically allocated string or NULL from
expand(). Never return the name parameter, which could be a the buf[]
buffer which is allocated on the stack by getdeadletter() and which
would then be used after getdeadletter() has returned.
Reported by: Coverity
CID: 1199383
Modified:
stable/10/usr.bin/mail/fio.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/usr.bin/mail/fio.c
==============================================================================
--- stable/10/usr.bin/mail/fio.c Fri May 20 06:38:46 2016
(r300273)
+++ stable/10/usr.bin/mail/fio.c Fri May 20 06:41:26 2016
(r300274)
@@ -367,10 +367,10 @@ expand(char *name)
name = savestr(xname);
}
if (!strpbrk(name, "~{[*?$`'\"\\"))
- return (name);
+ return (savestr(name));
if (pipe(pivec) < 0) {
warn("pipe");
- return (name);
+ return (NULL);
}
(void)snprintf(cmdbuf, sizeof(cmdbuf), "echo %s", name);
if ((sh = value("SHELL")) == NULL)
_______________________________________________
svn-src-stable-10@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"
