URL:
<http://gna.org/bugs/?20627>
Summary: RECEIVE_PACKET_END returns pointer to local memory
Project: Freeciv
Submitted by: cazfi
Submitted on: Sat 16 Mar 2013 11:27:47 PM EET
Category: None
Severity: 3 - Normal
Priority: 5 - Normal
Status: None
Assigned to: None
Originator Email:
Open/Closed: Open
Release:
Discussion Lock: Any
Operating System: None
Planned Release:
_______________________________________________________
Details:
Something noticed while updating freeciv-web:
RECEIVE_PACKET_START does:
struct packet_type packet_buf, *result = &packet_buf;
So "result" is pointer to local variable (structure) packet_buf.
RECEIVE_PACKET_END:
*result = packet_buf;
return result;
First line seems redundant. "result" already points to packet_buf so it's
copying it's own contents.
Latter line seems like critical bug: it returns pointer to local packet_buf,
which expires at the same time - memory pointed becomes subject to be reused
and overwritten with something else.
_______________________________________________________
Reply to this item at:
<http://gna.org/bugs/?20627>
_______________________________________________
Message sent via/by Gna!
http://gna.org/
_______________________________________________
Freeciv-dev mailing list
[email protected]
https://mail.gna.org/listinfo/freeciv-dev
