Re: [hackers] [sbase][ed][PATCH] Fix use-after-free

[Cág]

I wrote:
> Michael Forney wrote:
>  
> > This works, but I'm not sure why `s` is static here, since it is
> > cleared at the start of the function, and freed at the end of the
> > function.
> > 
> > Maybe I'm missing something, but I think it would be better to replace
> > the first `free(s.str)` with `s.str = NULL`, and make `s` have
> > automatic storage.
> 
> Like this or I misunderstood?  Because this works as well.
> [...]

Here's the patch:
---
 ed.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ed.c b/ed.c
index 57cead3..6c99a6d 100644
--- a/ed.c
+++ b/ed.c
@@ -839,9 +839,9 @@ join(void)
 {
        int i;
        char *t, c;
-       static String s;
+       String s;

-       free(s.str);
+       s.str = NULL;
        s.siz = s.cap = 0;
        for (i = line1;; i = nextln(i)) {
                for (t = gettxt(i); (c = *t) != '\n'; ++t)
--
2.18.4


-- 
caóc