[src/trunk]: src/usr.sbin/sysinst Fix invalid free(3) in sysinst(8)

[kamil <kamil%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/97721459295f
branches:  trunk
changeset: 323588:97721459295f
user:      kamil <kamil%NetBSD.org@localhost>
date:      Thu Jun 21 23:05:28 2018 +0000

description:
Fix invalid free(3) in sysinst(8)

The path variable is assigned with an allocation on the heap with
strdup(3). Later this pointer is changed with strsep(3) and this caused
invalid free(3).

Store the original pointer in a new helper variable opath and pass it to
free(3). With this change, the problem is going away.

Detected with MKSANITIZER=yes with AddressSanitizer.

diffstat:

 usr.sbin/sysinst/util.c |  12 +++++++-----
 1 files changed, 7 insertions(+), 5 deletions(-)

diffs (42 lines):

diff -r 40216890bf5f -r 97721459295f usr.sbin/sysinst/util.c
--- a/usr.sbin/sysinst/util.c   Thu Jun 21 22:56:42 2018 +0000
+++ b/usr.sbin/sysinst/util.c   Thu Jun 21 23:05:28 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: util.c,v 1.8 2018/05/18 12:23:22 joerg Exp $   */
+/*     $NetBSD: util.c,v 1.9 2018/06/21 23:05:28 kamil Exp $   */
 
 /*
  * Copyright 1997 Piermont Information Systems Inc.
@@ -1681,14 +1681,16 @@
 int
 binary_available(const char *prog)
 {
-        char *p, tmp[MAXPATHLEN], *path = getenv("PATH");
+        char *p, tmp[MAXPATHLEN], *path = getenv("PATH"), *opath;
  
         if (path == NULL)
                 return access(prog, X_OK) == 0;
         path = strdup(path);
         if (path == NULL)
                 return 0;
- 
+
+       opath = path;
+
         while ((p = strsep(&path, ":")) != NULL) {
                 if (strlcpy(tmp, p, MAXPATHLEN) >= MAXPATHLEN)
                         continue;
@@ -1697,11 +1699,11 @@
                 if (strlcat(tmp, prog, MAXPATHLEN) >= MAXPATHLEN)
                         continue;
                 if (access(tmp, X_OK) == 0) {
-                        free(path);
+                        free(opath);
                         return 1;
                 }
         }
-        free(path);
+        free(opath);
         return 0;
 }