[src/trunk]: src/lib/libc/string PR/42032 fixed overrun in bm_exec(), free(3)...

[shm <shm%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/dc68bb65eb86
branches:  trunk
changeset: 330113:dc68bb65eb86
user:      shm <shm%NetBSD.org@localhost>
date:      Mon Jun 23 10:43:25 2014 +0000

description:
PR/42032 fixed overrun in bm_exec(), free(3) clean ups

diffstat:

 lib/libc/string/bm.c |  12 +++++-------
 1 files changed, 5 insertions(+), 7 deletions(-)

diffs (40 lines):

diff -r 6c5b98c77849 -r dc68bb65eb86 lib/libc/string/bm.c
--- a/lib/libc/string/bm.c      Mon Jun 23 07:29:42 2014 +0000
+++ b/lib/libc/string/bm.c      Mon Jun 23 10:43:25 2014 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: bm.c,v 1.12 2012/06/25 22:32:46 abs Exp $      */
+/*     $NetBSD: bm.c,v 1.13 2014/06/23 10:43:25 shm Exp $      */
 
 /*-
  * Copyright (c) 1994
@@ -37,7 +37,7 @@
 #if 0
 static char sccsid[] = "@(#)bm.c       8.7 (Berkeley) 6/21/94";
 #else
-__RCSID("$NetBSD: bm.c,v 1.12 2012/06/25 22:32:46 abs Exp $");
+__RCSID("$NetBSD: bm.c,v 1.13 2014/06/23 10:43:25 shm Exp $");
 #endif
 #endif /* LIBC_SCCS && not lint */
 
@@ -162,10 +162,8 @@
 
        _DIAGASSERT(pat != NULL);
 
-       if (pat->pat != NULL)
-               free(pat->pat);
-       if (pat->delta != NULL)
-               free(pat->delta);
+       free(pat->pat);
+       free(pat->delta);
        free(pat);
 }
 
@@ -194,7 +192,7 @@
        e = base + n - 3 * pat->patlen;
        while (s < e) {
                k = d0[*s];             /* ufast skip loop */
-               while (k) {
+               while (k && s < e) {
                        k = d0[*(s += k)];
                        k = d0[*(s += k)];
                }