Re: ftp double free

2010-08-22 Thread Alexander Hall
On 08/21/10 20:18, Martynas Venckus wrote:
> it crashes for me about 50% of the times like this
> 
> $ make install
> ===>  docbook-4.4p0 depends on: docbook-dsssl-* - not found
> ===>  Verifying install for docbook-dsssl-* in textproc/docbook-dsssl
> ===>  Checking files for docbook-dsssl-1.72
>>> Fetch 
>>> http://downloads.sourceforge.net/sourceforge/docbook/docbook-dsssl-1.72
> .tar.gz
> docbook-dsssl-1.72.tar.gz 100% ||   326 KB00:00
> ftp in free(): error: chunk is already free
> Abort trap (core dumped)
> 
> since url_get is called recursively now, the last call would free
> proxyurl and cookie twice (cleanup_url_get);  this diff fixes it
> 
> - don't free proxyurl and cookie twice in the last recursive url_get call
> 
> Index: fetch.c
> ===
> RCS file: /cvs/src/usr.bin/ftp/fetch.c,v
> retrieving revision 1.102
> diff -u -r1.102 fetch.c
> --- fetch.c   23 Jul 2010 22:27:16 -  1.102
> +++ fetch.c   20 Aug 2010 23:17:00 -
> @@ -759,7 +759,9 @@
>   strncasecmp(cp, LOCATION, sizeof(LOCATION) - 1) == 0) {
>   cp += sizeof(LOCATION) - 1;
>   free(proxyurl);
> + proxyurl = NULL;
>   free(cookie);
> + cookie = NULL;

Apart from making the recursive calls using a tad less memory for each
invocation, I cannot see why those free's are needed there at all. They
are free'd in cleanup_url_get later anyway.

I think they should just be zapped.

/Alexander

>   if (strstr(cp, "://") == NULL) {
>  #ifdef SMALL
>   errx(1, "Relative redirect not supported");



ftp double free

2010-08-21 Thread Martynas Venckus
it crashes for me about 50% of the times like this

$ make install
===>  docbook-4.4p0 depends on: docbook-dsssl-* - not found
===>  Verifying install for docbook-dsssl-* in textproc/docbook-dsssl
===>  Checking files for docbook-dsssl-1.72
>> Fetch http://downloads.sourceforge.net/sourceforge/docbook/docbook-dsssl-1.72
.tar.gz
docbook-dsssl-1.72.tar.gz 100% ||   326 KB00:00
ftp in free(): error: chunk is already free
Abort trap (core dumped)

since url_get is called recursively now, the last call would free
proxyurl and cookie twice (cleanup_url_get);  this diff fixes it

- don't free proxyurl and cookie twice in the last recursive url_get call

Index: fetch.c
===
RCS file: /cvs/src/usr.bin/ftp/fetch.c,v
retrieving revision 1.102
diff -u -r1.102 fetch.c
--- fetch.c 23 Jul 2010 22:27:16 -  1.102
+++ fetch.c 20 Aug 2010 23:17:00 -
@@ -759,7 +759,9 @@
strncasecmp(cp, LOCATION, sizeof(LOCATION) - 1) == 0) {
cp += sizeof(LOCATION) - 1;
free(proxyurl);
+   proxyurl = NULL;
free(cookie);
+   cookie = NULL;
if (strstr(cp, "://") == NULL) {
 #ifdef SMALL
errx(1, "Relative redirect not supported");