]> Savannah Git Hosting - gnulib.git/commitdiff
uninorm/filter: Fix use-after-free bug.
authorBruno Haible <bruno@clisp.org>
Thu, 6 Jul 2017 22:14:53 +0000 (00:14 +0200)
committerBruno Haible <bruno@clisp.org>
Thu, 6 Jul 2017 22:15:28 +0000 (00:15 +0200)
* lib/uninorm/uninorm-filter.c (uninorm_filter_write): Maintain
sortbuf == filter->sortbuf invariant.
Reported by Coverity.

ChangeLog
lib/uninorm/uninorm-filter.c

index 78191f8a5cc17e4966c6a6fa0accb39424581810..0cba1ebbe6131d71ce80294873a1357094061dba 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2017-07-06  Bruno Haible  <bruno@clisp.org>
+
+       uninorm/filter: Fix use-after-free bug.
+       * lib/uninorm/uninorm-filter.c (uninorm_filter_write): Maintain
+       sortbuf == filter->sortbuf invariant.
+       Reported by Coverity.
+
 2017-07-06  Bruno Haible  <bruno@clisp.org>
 
        glob: Fix more memory leaks.
index 1e12713772388367e7fb3c8d50f4e6d8182dd0b0..d7f3bff23c4ba6cb52968aa65a41cd6d7e09fbbe 100644 (file)
@@ -131,7 +131,7 @@ uninorm_filter_write (struct uninorm_filter *filter, ucs4_t uc_arg)
 
   {
     /* Cache sortbuf and sortbuf_count in local register variables.  */
-    struct ucs4_with_ccc * const sortbuf = filter->sortbuf;
+    struct ucs4_with_ccc *sortbuf = filter->sortbuf;
     size_t sortbuf_count = filter->sortbuf_count;
     int i;
 
@@ -252,9 +252,11 @@ uninorm_filter_write (struct uninorm_filter *filter, ucs4_t uc_arg)
             if (filter->sortbuf != filter->sortbuf_preallocated)
               free (filter->sortbuf);
             filter->sortbuf = new_sortbuf;
+            /* Update cache of filter->sortbuf.  */
+            sortbuf = filter->sortbuf;
           }
-        filter->sortbuf[sortbuf_count].code = uc;
-        filter->sortbuf[sortbuf_count].ccc = ccc;
+        sortbuf[sortbuf_count].code = uc;
+        sortbuf[sortbuf_count].ccc = ccc;
         sortbuf_count++;
       }