зеркало из https://github.com/github/putty.git
When checking for an existing log, store the FILE * in a local variable.
It's not used outside logfopen, and leaving an infalid file pointer lying around in the log context caused a segfault if the user cancelled logging. Bug found by afl-fuzz before it had even started fuzzing.
This commit is contained in:
Родитель
e170041a5d
Коммит
c445c745ec
|
@ -164,6 +164,7 @@ void logfopen(void *handle)
|
|||
{
|
||||
struct LogContext *ctx = (struct LogContext *)handle;
|
||||
struct tm tm;
|
||||
FILE *fp;
|
||||
int mode;
|
||||
|
||||
/* Prevent repeat calls */
|
||||
|
@ -183,10 +184,10 @@ void logfopen(void *handle)
|
|||
conf_get_str(ctx->conf, CONF_host),
|
||||
conf_get_int(ctx->conf, CONF_port), &tm);
|
||||
|
||||
ctx->lgfp = f_open(ctx->currlogfilename, "r", FALSE); /* file already present? */
|
||||
if (ctx->lgfp) {
|
||||
fp = f_open(ctx->currlogfilename, "r", FALSE); /* file already present? */
|
||||
if (fp) {
|
||||
int logxfovr = conf_get_int(ctx->conf, CONF_logxfovr);
|
||||
fclose(ctx->lgfp);
|
||||
fclose(fp);
|
||||
if (logxfovr != LGXF_ASK) {
|
||||
mode = ((logxfovr == LGXF_OVR) ? 2 : 1);
|
||||
} else
|
||||
|
|
Загрузка…
Ссылка в новой задаче