History

Fix use after free for linker_arg

elements in linker_arg are used in TCCState structure and must thus not be freed when option parsing is finished. Declare linker_arg as a global static variable and free it after tcc_delete has been called on TCCState structure. This fix commit 7fb0482a4645d59068ccefe44a3a022b649e5a3a

Thomas Preud'homme committed 14 years ago

Commit 2eee1001 parent c52d7961 file · +2 −2Browse files

Unified · Split

tcc.c+2−2
@@ -35,6 +35,7 @@ static int do_bench = 0; · 34 unmodified lines
35static int gen_deps;35static int gen_deps;
36static const char *deps_outfile;36static const char *deps_outfile;
37static const char *m_option;37static const char *m_option;
38static char *linker_arg;
38 39
39#define TCC_OPTION_HAS_ARG 0x000140#define TCC_OPTION_HAS_ARG 0x0001
40#define TCC_OPTION_NOSEP 0x0002 /* cannot have space before option and arg */41#define TCC_OPTION_NOSEP 0x0002 /* cannot have space before option and arg */
@@ -280,7 +281,6 @@ static int parse_args(TCCState *s, int argc, char **argv) · 239 unmodified lines
280 const char *optarg, *p1, *r1;281 const char *optarg, *p1, *r1;
281 char *r;282 char *r;
282 int was_pthread;283 int was_pthread;
283 char *linker_arg = NULL;
284 unsigned long linker_argsize = 0;284 unsigned long linker_argsize = 0;
285 285
286 was_pthread = 0; /* is set if commandline contains -pthread key */286 was_pthread = 0; /* is set if commandline contains -pthread key */
@@ -478,7 +478,6 @@ static int parse_args(TCCState *s, int argc, char **argv) · 191 unmodified lines
478 }478 }
479 if ((r = (char *) tcc_set_linker(s, (char *)linker_arg, TRUE)))479 if ((r = (char *) tcc_set_linker(s, (char *)linker_arg, TRUE)))
480 tcc_error("unsupported linker option '%s'", r);480 tcc_error("unsupported linker option '%s'", r);
481 tcc_free(linker_arg);
482 /* fixme: these options could be different on your platform */481 /* fixme: these options could be different on your platform */
483 if (was_pthread && output_type != TCC_OUTPUT_OBJ) {482 if (was_pthread && output_type != TCC_OUTPUT_OBJ) {
484 dynarray_add((void ***)&files, &nb_files, "-lpthread");483 dynarray_add((void ***)&files, &nb_files, "-lpthread");
@@ -611,6 +610,7 @@ int main(int argc, char **argv) · 126 unmodified lines
611 }610 }
612 611
613 tcc_delete(s);612 tcc_delete(s);
613 tcc_free(linker_arg);
614 tcc_free(outfile);614 tcc_free(outfile);
615 615
616#ifdef MEM_DEBUG616#ifdef MEM_DEBUG

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t