diff options
| author | Rob Landley | 2006-01-10 05:30:28 +0000 |
|---|---|---|
| committer | Rob Landley | 2006-01-10 05:30:28 +0000 |
| commit | 71d6ccd801446c3551192e1080232c19c62cad44 (patch) | |
| tree | 4d41c541701c87ea8ee8dcf962bfa1a6ef297a98 | |
| parent | 8b0efdb1a1d0b67875518c0f77e1c1b2a814c048 (diff) | |
| download | busybox-71d6ccd801446c3551192e1080232c19c62cad44.zip busybox-71d6ccd801446c3551192e1080232c19c62cad44.tar.gz | |
With -a, the jump to mount_it_now can skip the initialization of f, and
if we don't zero it after closing it we re-close a filehandle that isn't
open, and since this is a file _pointer_ it segfaults on a double free.
Yeah, subtle bug. I need to break this out into separate functions if I can
figure out how to avoid making the code larger while doing so. Part of
the general -a and -o remount work I need to do, but that's after 1.1.0...
| -rw-r--r-- | util-linux/mount.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/util-linux/mount.c b/util-linux/mount.c index e0a2e29..4777e47 100644 --- a/util-linux/mount.c +++ b/util-linux/mount.c @@ -327,8 +327,11 @@ mount_it_now: } if(!rc || !f) break; } - if(f) fclose(f); - if(!f || !rc) break; + if(!f) break; + fclose(f); + // goto mount_it_now with -a can jump past the initialization + f=0; + if(!rc) break; } /* If the mount was successful, and we're maintaining an old-style |