From 85e5a019496c1f5ef1ae0393f21470de7f0ff046 Mon Sep 17 00:00:00 2001 From: Matthias Andree Date: Mon, 30 Mar 2020 21:02:40 +0200 Subject: fetchmail.c Avoid double-free in optmerge()'s STRING_MERGE macro. The memory leak free fix could try to double-free fields. Zero them out properly to avoid that. --- fetchmail.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'fetchmail.c') diff --git a/fetchmail.c b/fetchmail.c index c74d553c..2ad62205 100644 --- a/fetchmail.c +++ b/fetchmail.c @@ -974,8 +974,8 @@ static void optmerge(struct query *h2, struct query *h1, int force) list_merge(&h2->domainlist, &h1->domainlist, force); list_merge(&h2->antispam, &h1->antispam, force); -#define FLAG_MERGE(fld) do { if (force ? !!h1->fld : !h2->fld) h2->fld = h1->fld; } while (0) -#define STRING_MERGE(fld) do { if (force ? !!h1->fld : !h2->fld) { if (h2->fld) free((void *)h2->fld); h2->fld = h1->fld; } } while (0) +#define FLAG_MERGE(fld) do { if (force ? !!h1->fld : !h2->fld) h2->fld = h1->fld; } while (0) +#define STRING_MERGE(fld) do { if (force ? !!h1->fld : !h2->fld) { if (h2->fld) free((void *)h2->fld), h2->fld = 0; if (h1->fld) h2->fld = xstrdup(h1->fld); } } while (0) STRING_MERGE(server.via); FLAG_MERGE(server.protocol); STRING_MERGE(server.service); -- cgit v1.2.3