summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRob Landley2006-01-10 05:30:28 +0000
committerRob Landley2006-01-10 05:30:28 +0000
commit71d6ccd801446c3551192e1080232c19c62cad44 (patch)
tree4d41c541701c87ea8ee8dcf962bfa1a6ef297a98
parent8b0efdb1a1d0b67875518c0f77e1c1b2a814c048 (diff)
downloadbusybox-71d6ccd801446c3551192e1080232c19c62cad44.zip
busybox-71d6ccd801446c3551192e1080232c19c62cad44.tar.gz
With -a, the jump to mount_it_now can skip the initialization of f, and
if we don't zero it after closing it we re-close a filehandle that isn't open, and since this is a file _pointer_ it segfaults on a double free. Yeah, subtle bug. I need to break this out into separate functions if I can figure out how to avoid making the code larger while doing so. Part of the general -a and -o remount work I need to do, but that's after 1.1.0...
-rw-r--r--util-linux/mount.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/util-linux/mount.c b/util-linux/mount.c
index e0a2e29..4777e47 100644
--- a/util-linux/mount.c
+++ b/util-linux/mount.c
@@ -327,8 +327,11 @@ mount_it_now:
}
if(!rc || !f) break;
}
- if(f) fclose(f);
- if(!f || !rc) break;
+ if(!f) break;
+ fclose(f);
+ // goto mount_it_now with -a can jump past the initialization
+ f=0;
+ if(!rc) break;
}
/* If the mount was successful, and we're maintaining an old-style