diff options
| author | Denys Vlasenko | 2022-08-18 16:23:55 +0200 |
|---|---|---|
| committer | Denys Vlasenko | 2022-08-18 16:23:55 +0200 |
| commit | 41d5f800a14769704082f7faeabb8435285499be (patch) | |
| tree | 18f6ec45a450040aae10f3aa13a2f45c2662a79b | |
| parent | 7c2a3bdde0a1316771fdd07ff03413f00383f70e (diff) | |
| download | busybox-41d5f800a14769704082f7faeabb8435285499be.zip busybox-41d5f800a14769704082f7faeabb8435285499be.tar.gz | |
bc: hopefully fix bug 14956 (use-after-free)
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
| -rw-r--r-- | miscutils/bc.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/miscutils/bc.c b/miscutils/bc.c index ab785bb..1300a63 100644 --- a/miscutils/bc.c +++ b/miscutils/bc.c @@ -2892,6 +2892,8 @@ static char peek_inbuf(void) ) { xc_read_line(&G.input_buffer, G.prs.lex_input_fp); G.prs.lex_inbuf = G.input_buffer.v; + // lex_next_at may point to now-freed data, update it: + G.prs.lex_next_at = G.prs.lex_inbuf; if (G.input_buffer.len <= 1) // on EOF, len is 1 (NUL byte) G.prs.lex_input_fp = NULL; } |