From d8443b7bdc8c8eb843e4acf4ea5196b9429cde5a Mon Sep 17 00:00:00 2001 From: nicm Date: Tue, 31 Jul 2018 13:06:44 +0000 Subject: [PATCH] Do not leak path or use it after free. --- usr.bin/tmux/cmd-load-buffer.c | 6 ++++-- usr.bin/tmux/cmd-save-buffer.c | 5 +++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/usr.bin/tmux/cmd-load-buffer.c b/usr.bin/tmux/cmd-load-buffer.c index f89d4691d46..5309dc8925d 100644 --- a/usr.bin/tmux/cmd-load-buffer.c +++ b/usr.bin/tmux/cmd-load-buffer.c @@ -1,4 +1,4 @@ -/* $OpenBSD: cmd-load-buffer.c,v 1.52 2018/07/11 08:29:21 nicm Exp $ */ +/* $OpenBSD: cmd-load-buffer.c,v 1.53 2018/07/31 13:06:44 nicm Exp $ */ /* * Copyright (c) 2009 Tiago Cunha @@ -85,7 +85,7 @@ cmd_load_buffer_exec(struct cmd *self, struct cmdq_item *item) error = server_set_stdin_callback(c, cmd_load_buffer_callback, cdata, &cause); if (error != 0) { - cmdq_error(item, "%s: %s", path, cause); + cmdq_error(item, "-: %s", cause); free(cause); return (CMD_RETURN_ERROR); } @@ -93,6 +93,8 @@ cmd_load_buffer_exec(struct cmd *self, struct cmdq_item *item) } file = server_client_get_path(c, path); + free(path); + f = fopen(file, "rb"); if (f == NULL) { cmdq_error(item, "%s: %s", file, strerror(errno)); diff --git a/usr.bin/tmux/cmd-save-buffer.c b/usr.bin/tmux/cmd-save-buffer.c index 1f433c72eed..20b05650caa 100644 --- a/usr.bin/tmux/cmd-save-buffer.c +++ b/usr.bin/tmux/cmd-save-buffer.c @@ -1,4 +1,4 @@ -/* $OpenBSD: cmd-save-buffer.c,v 1.44 2018/07/11 08:29:21 nicm Exp $ */ +/* $OpenBSD: cmd-save-buffer.c,v 1.45 2018/07/31 13:06:44 nicm Exp $ */ /* * Copyright (c) 2009 Tiago Cunha @@ -106,6 +106,8 @@ cmd_save_buffer_exec(struct cmd *self, struct cmdq_item *item) flags = "ab"; file = server_client_get_path(c, path); + free(path); + f = fopen(file, flags); if (f == NULL) { cmdq_error(item, "%s: %s", file, strerror(errno)); @@ -122,7 +124,6 @@ cmd_save_buffer_exec(struct cmd *self, struct cmdq_item *item) fclose(f); free(file); - free(path); return (CMD_RETURN_NORMAL); -- 2.20.1