commit aacfa18b79f459b8419f424079d50fc5bc263791
parent b089261c3a7bdc6fb1efd84b7f097667d9f1fced
Author: Roberto E. Vargas Caballero <k0ga@shike2.com>
Date: Wed, 29 Nov 2023 15:47:51 +0100
ed: Avoid dangling pointer in getrhs()
If the string r.str is freed but error() is called then
next call will see a pointer that maybe it will try to free
because the call to error unwind the frame stack.
Diffstat:
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/ed.c b/ed.c
@@ -1102,9 +1102,9 @@ getrhs(int delim)
}
if (!strcmp("%", s.str)) {
- free(s.str);
if (!rhs)
error("no previous substitution");
+ free(s.str);
} else {
free(rhs);
rhs = s.str;