aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDavid Oberhollenzer <david.oberhollenzer@sigma-star.at>2019-07-01 10:51:50 +0200
committerDavid Oberhollenzer <david.oberhollenzer@sigma-star.at>2019-07-01 11:46:40 +0200
commitd5fbb8baf0474378c863739d8ecb0213218d6b77 (patch)
tree0328b4f2d43582861ab0a15b2352bd8a7a75771e
parentefe6acd9c5b80b77a32896bc85479ce3ecf8cd95 (diff)
Fix double free in GNU tar sparse file parser
The intention was to free the temporary object in addition to the list. Since the temp pointer is also used for iterating the list, this resulted in a double free instead of the intended. This commit fixes the double free by replacing the recycled variable based list free with the helper function intended to do this. Bug found using scan-build. Signed-off-by: David Oberhollenzer <david.oberhollenzer@sigma-star.at>
-rw-r--r--lib/tar/read_header.c6
1 files changed, 1 insertions, 5 deletions
diff --git a/lib/tar/read_header.c b/lib/tar/read_header.c
index 95d7d0c..de6f0cd 100644
--- a/lib/tar/read_header.c
+++ b/lib/tar/read_header.c
@@ -203,11 +203,7 @@ fail_format:
fputs("malformed GNU pax sparse file record\n", stderr);
goto fail;
fail:
- while (list != NULL) {
- ent = list;
- list = list->next;
- free(ent);
- }
+ free_sparse_list(list);
free(ent);
return NULL;
}