diff options
| author | David Oberhollenzer <david.oberhollenzer@sigma-star.at> | 2019-07-01 10:51:50 +0200 |
|---|---|---|
| committer | David Oberhollenzer <david.oberhollenzer@sigma-star.at> | 2019-07-01 11:46:40 +0200 |
| commit | d5fbb8baf0474378c863739d8ecb0213218d6b77 (patch) | |
| tree | 0328b4f2d43582861ab0a15b2352bd8a7a75771e /lib | |
| parent | efe6acd9c5b80b77a32896bc85479ce3ecf8cd95 (diff) | |
Fix double free in GNU tar sparse file parser
The intention was to free the temporary object in addition to the list.
Since the temp pointer is also used for iterating the list, this resulted
in a double free instead of the intended.
This commit fixes the double free by replacing the recycled variable based
list free with the helper function intended to do this.
Bug found using scan-build.
Signed-off-by: David Oberhollenzer <david.oberhollenzer@sigma-star.at>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/tar/read_header.c | 6 |
1 files changed, 1 insertions, 5 deletions
diff --git a/lib/tar/read_header.c b/lib/tar/read_header.c index 95d7d0c..de6f0cd 100644 --- a/lib/tar/read_header.c +++ b/lib/tar/read_header.c @@ -203,11 +203,7 @@ fail_format: fputs("malformed GNU pax sparse file record\n", stderr); goto fail; fail: - while (list != NULL) { - ent = list; - list = list->next; - free(ent); - } + free_sparse_list(list); free(ent); return NULL; } |