From c445c745ecef1d00e57b77732bb0928881977149 Mon Sep 17 00:00:00 2001 From: Ben Harris Date: Sat, 17 Oct 2015 12:12:23 +0100 Subject: [PATCH] When checking for an existing log, store the FILE * in a local variable. It's not used outside logfopen, and leaving an infalid file pointer lying around in the log context caused a segfault if the user cancelled logging. Bug found by afl-fuzz before it had even started fuzzing. --- logging.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/logging.c b/logging.c index 954721b9..a40d32a6 100644 --- a/logging.c +++ b/logging.c @@ -164,6 +164,7 @@ void logfopen(void *handle) { struct LogContext *ctx = (struct LogContext *)handle; struct tm tm; + FILE *fp; int mode; /* Prevent repeat calls */ @@ -183,10 +184,10 @@ void logfopen(void *handle) conf_get_str(ctx->conf, CONF_host), conf_get_int(ctx->conf, CONF_port), &tm); - ctx->lgfp = f_open(ctx->currlogfilename, "r", FALSE); /* file already present? */ - if (ctx->lgfp) { + fp = f_open(ctx->currlogfilename, "r", FALSE); /* file already present? */ + if (fp) { int logxfovr = conf_get_int(ctx->conf, CONF_logxfovr); - fclose(ctx->lgfp); + fclose(fp); if (logxfovr != LGXF_ASK) { mode = ((logxfovr == LGXF_OVR) ? 2 : 1); } else