help / color / mirror / code / Atom feed
* [PATCH] Crash if $TMPPREFIX has invalid or read-only path
@ 2023-09-11  3:38 Bart Schaefer
  0 siblings, 0 replies; only message in thread
From: Bart Schaefer @ 2023-09-11  3:38 UTC (permalink / raw)
  To: Zsh hackers list

Easily seen with

zsh -fc 'TMPPREFIX=/tmp/xxx/zsh; echo =(<<<"")'

getoutputfile() calls free() on memory that was allocated on the heap
by gettempname().

diff --git a/Src/exec.c b/Src/exec.c
index 8f9d5a885..3a8b3e951 100644
--- a/Src/exec.c
+++ b/Src/exec.c
@@ -4897,7 +4897,6 @@ getoutputfile(char *cmd, char **eptr)

     if ((fd = open(nam, O_WRONLY | O_CREAT | O_EXCL | O_NOCTTY, 0600)) < 0) {
        zerr("process substitution failed: %e", errno);
-       free(nam);
        if (!s)
        return NULL;

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2023-09-11  3:44 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-09-11  3:38 [PATCH] Crash if $TMPPREFIX has invalid or read-only path Bart Schaefer

Code repositories for project(s) associated with this public inbox


This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).