[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
use-after-free in rl_display_match_list
From: |
Grisha Levit |
Subject: |
use-after-free in rl_display_match_list |
Date: |
Mon, 20 Mar 2023 12:55:16 -0400 |
A SIGINT received during get_y_or_n in display_matches can leave
rl_display_match_list working with an already-freed matches array.
The check below should prevent this:
diff --git a/lib/readline/complete.c b/lib/readline/complete.c
index 2016d393..d6dd7dca 100644
--- a/lib/readline/complete.c
+++ b/lib/readline/complete.c
@@ -1745,7 +1745,8 @@ display_matches (char **matches)
}
}
- rl_display_match_list (matches, len, max);
+ if (_rl_complete_display_matches_interrupt == 0)
+ rl_display_match_list (matches, len, max);
rl_forced_update_display ();
rl_display_fixed = 1;
- use-after-free in rl_display_match_list,
Grisha Levit <=