From b3959fc691e606857a3c6e9b316ec34819972245 Mon Sep 17 00:00:00 2001

From: Jim Meyering <meyering@redhat.com>

Date: Sat, 28 Aug 2010 17:45:29 +0200

Subject: [PATCH] tac: avoid double free

* src/tac.c (main): Reading a line longer than 16KiB would cause

tac to realloc its primary buffer.  Then, just before exit, tac

would mistakenly free the original (now free'd) buffer.

This bug was introduced by commit be6c13e7, "maint: always free a

buffer, to avoid even semblance of a leak".

* tests/misc/tac (double-free): New test, to exercise this.

Reported by Salvo Tomaselli in <http://bugs.debian.org/594666>.

---

 src/tac.c      |    6 ++++--

 tests/misc/tac |    6 ++++++

 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/tac.c b/src/tac.c

index cec9736..859e006 100644

--- a/src/tac.c

+++ b/src/tac.c

@@ -633,7 +633,6 @@ main (int argc, char **argv)

   if (! (read_size < half_buffer_size && half_buffer_size < G_buffer_size))

     xalloc_die ();

   G_buffer = xmalloc (G_buffer_size);

-  void *buf = G_buffer;

   if (sentinel_length)

     {

       strcpy (G_buffer, separator);

@@ -666,6 +665,9 @@ main (int argc, char **argv)

       error (0, errno, "-");

       ok = false;

     }

-  free (buf);

+

+  size_t offset = sentinel_length ? sentinel_length : 1;

+  free (G_buffer - offset);

+

   exit (ok ? EXIT_SUCCESS : EXIT_FAILURE);

 }

diff --git a/tests/misc/tac b/tests/misc/tac

index 7631049..4130c00 100755

--- a/tests/misc/tac

+++ b/tests/misc/tac

@@ -24,6 +24,9 @@ my $prog = 'tac';

 my $bad_dir = 'no/such/dir';

+# This must be longer than 16KiB to trigger the double free in coreutils-8.5.

+my $long_line = 'o' x (16 * 1024 + 1);

+

 my @Tests =

 (

   ['segfault', '-r', {IN=>"a\n"}, {IN=>"b\n"}, {OUT=>"a\nb\n"}],

@@ -67,6 +70,9 @@ my @Tests =

    {ERR_SUBST => "s,`$bad_dir': .*,...,"},

    {ERR => "$prog: cannot create temporary file in ...\n"},

    {EXIT => 1}],

+

+  # coreutils-8.5's tac would double-free its primary buffer.

+  ['double-free', {IN=>$long_line}, {OUT=>$long_line}],

 );

 @Tests = triple_test \@Tests;

--

1.7.2.2.510.g7180a