summaryrefslogtreecommitdiff
path: root/lib/libmenu
diff options
context:
space:
mode:
authorblymn <blymn@NetBSD.org>2002-08-19 11:01:11 +0000
committerblymn <blymn@NetBSD.org>2002-08-19 11:01:11 +0000
commitf645d021ced9e53ff86d58b249796965471d3cf3 (patch)
tree518d1b649885c5711e473bb51029019aeeec6dda /lib/libmenu
parent7360d7b6ae7d2788501ef4570581367725269f46 (diff)
Allocate private string buffers for the menu mark and unmark to prevent
a double free of the string memory. This fixes PR 17937.
Diffstat (limited to 'lib/libmenu')
-rw-r--r--lib/libmenu/menu.c33
1 files changed, 32 insertions, 1 deletions
diff --git a/lib/libmenu/menu.c b/lib/libmenu/menu.c
index 692a8495378..79a6c50700a 100644
--- a/lib/libmenu/menu.c
+++ b/lib/libmenu/menu.c
@@ -1,4 +1,4 @@
-/* $NetBSD: menu.c,v 1.12 2002/07/29 13:03:51 blymn Exp $ */
+/* $NetBSD: menu.c,v 1.13 2002/08/19 11:01:11 blymn Exp $ */
/*-
* Copyright (c) 1998-1999 Brett Lymn (blymn@baea.com.au, brett_lymn@yahoo.com.au)
@@ -455,10 +455,41 @@ new_menu(ITEM **items)
/* set a default window if none already set. */
if (the_menu->menu_win == NULL)
the_menu->scrwin = stdscr;
+
+ /* make a private copy of the mark string */
+ if (_menui_default_menu.mark.string != NULL) {
+ if ((the_menu->mark.string =
+ (char *) malloc((unsigned) _menui_default_menu.mark.length + 1))
+ == NULL) {
+ free(the_menu);
+ return NULL;
+ }
+
+ strlcpy(the_menu->mark.string, _menui_default_menu.mark.string,
+ (unsigned) _menui_default_menu.mark.length);
+ }
+ /* make a private copy of the unmark string too */
+ if (_menui_default_menu.unmark.string != NULL) {
+ if ((the_menu->unmark.string =
+ (char *) malloc((unsigned) _menui_default_menu.unmark.length + 1))
+ == NULL) {
+ free(the_menu);
+ return NULL;
+ }
+
+ strlcpy(the_menu->unmark.string,
+ _menui_default_menu.unmark.string,
+ (unsigned) _menui_default_menu.unmark.length);
+ }
+
/* now attach the items, if any */
if (items != NULL) {
if(set_menu_items(the_menu, items) < 0) {
+ if (the_menu->mark.string != NULL)
+ free(the_menu->mark.string);
+ if (the_menu->unmark.string != NULL)
+ free(the_menu->unmark.string);
free(the_menu);
return NULL;
}