aniani/elinks
1
0
Fork 0
mirror of https://github.com/rkd77/elinks.git synced 2024-12-04 14:46:47 -05:00
Code

Bug 770: Fix URI leak in lun_resume

Browse Source 
To reproduce:
- Configure with --enable-debug.
- Go to http://elinks.cz/
- Set the cursor on the "About" link and press d to download,
- ELinks asks where to save the file.  Cancel that with Esc.
  This leaves session.download_uri != NULL.
- Go to /etc/passwd
- ELinks asks what to do with the file.  Choose to download.
- ELinks asks where to save the file.  Type the name of a new file
  and press Enter.
- Again go to /etc/passwd
- ELinks asks what to do with the file.  Choose to download.
- ELinks asks where to save the file.  Type the same name as before
  and press Enter.
- ELinks asks whether to resume or overwrite.  Choose to resume.
  This changes session.download_uri and leaks the original URI.
- Quit ELinks.  It reports memory leaks:

0x88936d8:28 @ alloc'd at /home/Kalle/src/elinks-0.12/src/util/hash.c:89
0x88dac00:95 @ alloc'd at /home/Kalle/src/elinks-0.12/src/protocol/uri.c:1551
0x88c33a8:4104 @ alloc'd at /home/Kalle/src/elinks-0.12/src/util/hash.c:41

This commit fixes the leak, but it's still a bug that lun_resume() can
replace the session.download_uri that will be used by another pending
download.  In particular, this might happen if the user first presses
d to download, and then while ELinks is asking for the file name, a
web script changes window.location to a different URI and that causes
ELinks to ask what to do with the file.  So I'm leaving the FIXME
comment in for now.
This commit is contained in:
Kalle Olavi Niemitalo 2009-07-19 02:34:54 +03:00 committed by Kalle Olavi Niemitalo
parent 38d7bffced
commit 2f04a38c6f
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/session/download.c
View File

@ -663,6 +663,8 @@ lun_resume(void *lun_hop_)
cmdw_hop->magic = COMMON_DOWNLOAD_DO;
cmdw_hop->ses = type_query->ses;
/* FIXME: Current ses->download_uri is overwritten here --witekfl */
if (cmdw_hop->ses->download_uri)
done_uri(cmdw_hop->ses->download_uri);
cmdw_hop->ses->download_uri = get_uri_reference(type_query->uri);
if (type_query->external_handler) mem_free_if(codw_hop->file);