From 4d9bc2923b8aaddce31c4ceb8f7f06c684e74240 Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Sat, 26 Dec 2009 22:54:12 +0200 Subject: [PATCH] Ticket #1906: edit: crash on file open whoen some Syntax files are absent (reported by pavlinux) valgrind log snippet: (from here http://pavlinux.ru/vgmc.log) > ==26750== HEAP SUMMARY: > ==26750== in use at exit: 0 bytes in 0 blocks > ==26750== ==26749== Invalid free() / delete / delete[] > ==26749== at 0x4A06DD8: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) > ==26749== by 0x48B5F9: edit_read_syntax_rules (syntax.c:766) > ==26749== by 0x48CDA7: edit_read_syntax_file (syntax.c:1140) > ==26749== by 0x48D06D: edit_load_syntax (syntax.c:1219) > ==26749== by 0x4762F6: edit_init (edit.c:834) > ==26749== by 0x4858FC: edit_file (editwidget.c:241) > ==26749== by 0x44D017: do_edit_at_line (cmd.c:304) > ==26749== by 0x44D098: do_edit (cmd.c:324) > ==26749== by 0x44D10E: edit_cmd (cmd.c:331) > ==26749== by 0x46C2E4: midnight_execute_cmd (main.c:1193) > ==26749== by 0x46CD41: midnight_callback (main.c:1690) > ==26749== by 0x4353F4: buttonbar_call (widget.c:2654) > ==26749== Address 0x60f8e10 is 0 bytes inside a block of size 30 free'd > ==26749== at 0x4A06DD8: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) > ==26749== by 0x48B32C: open_include_file (syntax.c:705) > ==26749== by 0x48B6E8: edit_read_syntax_rules (syntax.c:784) > ==26749== by 0x48CDA7: edit_read_syntax_file (syntax.c:1140) > ==26749== by 0x48D06D: edit_load_syntax (syntax.c:1219) > ==26749== by 0x4762F6: edit_init (edit.c:834) > ==26749== by 0x4858FC: edit_file (editwidget.c:241) > ==26749== by 0x44D017: do_edit_at_line (cmd.c:304) > ==26749== by 0x44D098: do_edit (cmd.c:324) > ==26749== by 0x44D10E: edit_cmd (cmd.c:331) > ==26749== by 0x46C2E4: midnight_execute_cmd (main.c:1193) > ==26749== by 0x46CD41: midnight_callback (main.c:1690) We see doublefree memory corruption here, introduced by spurious 'g_free(error_file_name)' of changeset:0c17219b2ab5cb5fe2e73f8d7cc9c11c755a3ae4 (syntax.c file) The rest of code seems to store real syntax file name there. Making code the same as part above: don't free 'error_file_name' Signed-off-by: Sergei Trofimovich --- edit/syntax.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/edit/syntax.c b/edit/syntax.c index b8784d518..7479483cd 100644 --- a/edit/syntax.c +++ b/edit/syntax.c @@ -693,11 +693,10 @@ static FILE *open_include_file (const char *filename) g_free (error_file_name); error_file_name = g_strconcat (mc_home, PATH_SEP_STR, "syntax", PATH_SEP_STR, filename, (char *) NULL); - - if ((f = fopen (error_file_name, "r"))) { - g_free (error_file_name); + f = fopen (error_file_name, "r"); + if (f) return f; - } + g_free (error_file_name); error_file_name = g_strconcat (mc_home_alt, PATH_SEP_STR "syntax" PATH_SEP_STR, filename, (char *) NULL); -- 2.11.4.GIT