cpet/freebsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

games/acm: prevent free()ing unitialized data

Browse Source 
acm may coredump immediately after starting on systems which do not
zero malloc()ed memory e.g., MALLOC_CONF=junk:true. This is because
one of the fields of a malloc()ed data structure (w) contains a
pointer (w->csPool2), and if that pointer is never used, then later
code will find the pointer is non-NULL and try to free() the memory
pointed to by the pointer.

PR:		215427
Submitted by:	Jeff Gibbons <jgibbons@protogate.com>
This commit is contained in:
Jan Beich 2017-05-12 22:33:54 +00:00
parent aa38b49434
commit af98de3b3e
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=440736
2 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
games/acm/Makefile
View File

@ -3,7 +3,7 @@
PORTNAME= acm
PORTVERSION= 5.0
PORTREVISION= 2
PORTREVISION= 3
CATEGORIES= games
MASTER_SITES= http://mirror.amdmi3.ru/distfiles/

16
games/acm/files/patch-V_lib_InitAWin.c Normal file
View File

@ -0,0 +1,16 @@
--- V/lib/InitAWin.c.orig 1998-08-14 21:09:02 UTC
+++ V/lib/InitAWin.c
@@ -69,6 +69,13 @@ InitializeX11AWindow(Display * dpy, int screen, Drawab
w->csPool1 = (ColorSegment *) malloc(w->CSSize1 * sizeof(ColorSegment));
memset(w->csPool1, 0, w->CSSize1 * sizeof(ColorSegment));
+ // Initialize csPool2 so program doesn't crash later,
+ // when trying to free it.
+ {
+ w->CSSize2 = 0;
+ w->csPool2 = (ColorSegment *) NULL;
+ }
+
w->scanLine = (ScanLine *) malloc((w->height + 1) * sizeof(ScanLine));
w->lastScanLine = (ScanLine *) malloc((w->height + 1) * sizeof(ScanLine));
w->otherLastScanLine = NULL;