mirror of
https://github.com/irssi/irssi.git
synced 2024-09-01 04:14:16 -04:00
Use-after-frees
Hi folks! I tried clang-static-analyzer on irssi 1.1.1, it seems like it finds some things. Here's a diff, but there might be more that you would want to check, or choose to work differently. (in special-vars.c, ret is commands->data sometime) I hope it's not too much trouble if reported as a confidential bug. Thanks.
This commit is contained in:
parent
19d84bc16e
commit
610ab2dafa
@ -289,8 +289,9 @@ void modules_deinit(void)
|
||||
|
||||
while (list != NULL) {
|
||||
module_uniq_destroy(list->data);
|
||||
g_free(list->data);
|
||||
gconstpointer tmp = list->data;
|
||||
list = g_slist_remove(list, list->data);
|
||||
g_free(tmp);
|
||||
}
|
||||
|
||||
g_hash_table_destroy(idlookup);
|
||||
|
@ -64,9 +64,10 @@ static void rawlog_add(RAWLOG_REC *rawlog, char *str)
|
||||
if (rawlog->nlines < rawlog_lines || rawlog_lines <= 2)
|
||||
rawlog->nlines++;
|
||||
else {
|
||||
g_free(rawlog->lines->data);
|
||||
gconstpointer tmp = rawlog->lines->data;
|
||||
rawlog->lines = g_slist_remove(rawlog->lines,
|
||||
rawlog->lines->data);
|
||||
g_free(tmp);
|
||||
}
|
||||
|
||||
if (rawlog->logging) {
|
||||
|
@ -620,8 +620,8 @@ void eval_special_string(const char *cmd, const char *data,
|
||||
/* FIXME: window item would need reference counting as well,
|
||||
eg. "/EVAL win close;say hello" wouldn't work now.. */
|
||||
|
||||
g_free(ret);
|
||||
commands = g_slist_remove(commands, commands->data);
|
||||
g_free(ret);
|
||||
}
|
||||
g_free(orig);
|
||||
}
|
||||
|
@ -1424,8 +1424,9 @@ void themes_reload(void)
|
||||
change_theme(settings_get_str("theme"), FALSE);
|
||||
|
||||
while (refs != NULL) {
|
||||
theme_unref(refs->data);
|
||||
gconstpointer tmp = refs->data;
|
||||
refs = g_slist_remove(refs, refs->data);
|
||||
theme_unref(tmp);
|
||||
}
|
||||
}
|
||||
|
||||
|
@ -57,8 +57,8 @@ void dcc_unregister_type(const char *type)
|
||||
|
||||
pos = gslist_find_string(dcc_types, type);
|
||||
if (pos != NULL) {
|
||||
g_free(pos->data);
|
||||
dcc_types = g_slist_remove(dcc_types, pos->data);
|
||||
g_free(pos->data);
|
||||
}
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user