[src/trunk]: src/dist/nvi/common Use after free (Coverity 273146)

[spz <spz%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/6b3b641e7fd4
branches:  trunk
changeset: 780201:6b3b641e7fd4
user:      spz <spz%NetBSD.org@localhost>
date:      Sun Jul 15 09:13:59 2012 +0000

description:
Use after free (Coverity 273146)

diffstat:

 dist/nvi/common/exf.c |  9 +++++++--
 1 files changed, 7 insertions(+), 2 deletions(-)

diffs (38 lines):

diff -r 88ef9712a27b -r 6b3b641e7fd4 dist/nvi/common/exf.c
--- a/dist/nvi/common/exf.c     Sun Jul 15 09:08:29 2012 +0000
+++ b/dist/nvi/common/exf.c     Sun Jul 15 09:13:59 2012 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: exf.c,v 1.4 2009/11/14 20:01:20 tnozaki Exp $ */
+/*     $NetBSD: exf.c,v 1.5 2012/07/15 09:13:59 spz Exp $ */
 
 /*-
  * Copyright (c) 1992, 1993, 1994
@@ -173,6 +173,7 @@
                            exfp->minode == sb.st_ino && 
                            (exfp != sp->ep || exfp->refcnt > 1)) {
                                ep = exfp;
+                               oname = ep->rcv_path;
                                goto postinit;
                        }
                }
@@ -807,8 +808,10 @@
                (void)close(ep->rcv_fd);
        if (ep->env_path != NULL)
                free(ep->env_path);
-       if (ep->rcv_path != NULL)
+       if (ep->rcv_path != NULL) {
                free(ep->rcv_path);
+               ep->rcv_path = NULL;
+       }
        if (ep->rcv_mpath != NULL)
                free(ep->rcv_mpath);
 
@@ -1251,6 +1254,8 @@
        }
        if (bp != NULL)
                FREE_SPACE(sp, bp, blen);
+       if (d != NULL)
+               free(d);
        return (0);
 
 alloc_err: