Re: [Lynx-dev] lynx2.8.6dev.9

[Thomas Dickey]

On Thu, 30 Dec 2004, Gisle Vanem wrote:

> This version built with djgpp and S-Lang crashes due to (AFAICS)
> wrong use of HTSACopy/StrAllocCopy. Backtrace:

...

> In HTSACopy, line 262 there's a FREE(*dest), but I cannot see
> that '*dest' was malloced in LYCheckForProxyURL():
>
> if ((cp1 = strchr((cp + 1), ':')) != NULL) {
>    if ((cp2 = strchr((cp + 1), '/')) != NULL && cp2 < cp1)
>        return (NOT_A_URL_TYPE);
>    *cp1 = '\0';
>    StrAllocCopy(cp2, cp);       << this caused free() to crash.
>
> Isn't *dest = cp2? So it is clealy not malloced. I'm on a limb here,
> but this patch works here:

I see - it was this change:

+ modify LYCheckForProxyURL() to check if a colon follows a slash, which would
  make the colon not part of a URL (report/patch by Matt Kraal, Debian
  #240237).

The correct fix would reset cp2 to null before the StrAllocCopy()

> --- lyutils.c.orig      2004-12-30 11:12:00
> +++ lyutils.c   2004-12-30 18:45:04 +0100
> @@ -2009,7 +2009,7 @@
>       if ((cp2 = strchr((cp + 1), '/')) != NULL && cp2 < cp1)
>           return (NOT_A_URL_TYPE);
>       *cp1 = '\0';
> -       StrAllocCopy(cp2, cp);
> +        StrAllocCopy(cp1, cp2);
>       *cp1 = ':';
>       StrAllocCat(cp2, "_proxy");
>       if (LYGetEnv(cp2) != NULL) {
>
> --gv
>
>
>
>
>
> _______________________________________________
> Lynx-dev mailing list
> address@hidden
> http://lists.nongnu.org/mailman/listinfo/lynx-dev

--
Thomas E. Dickey
http://invisible-island.net
ftp://invisible-island.net