aboutsummaryrefslogtreecommitdiffstats
path: root/lib/fuse.c
diff options
context:
space:
mode:
authorMiklos Szeredi <mszeredi@suse.cz>2012-07-19 15:05:56 +0200
committerMiklos Szeredi <mszeredi@suse.cz>2012-07-19 15:05:56 +0200
commit3c4c063a2fd5cc6e9ce2b5db82e2a0dfa59b2e40 (patch)
tree8535cd3e7deec15acb3eae4d2728a03640e3f778 /lib/fuse.c
parent86439d5ab68431c6246d5f869c7f0483fbf585e0 (diff)
downloadandroid_external_fuse-3c4c063a2fd5cc6e9ce2b5db82e2a0dfa59b2e40.tar.gz
android_external_fuse-3c4c063a2fd5cc6e9ce2b5db82e2a0dfa59b2e40.tar.bz2
android_external_fuse-3c4c063a2fd5cc6e9ce2b5db82e2a0dfa59b2e40.zip
Fix crash caused by freeing a stack address
The failure path of try_get_path2() erronously tried to free the "path1" value (an address on the stack) instead of the allocated string pointed to by "path1". This caused the library to crash. Reported by Itay Perl
Diffstat (limited to 'lib/fuse.c')
-rw-r--r--lib/fuse.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/fuse.c b/lib/fuse.c
index 644878b..3c7f642 100644
--- a/lib/fuse.c
+++ b/lib/fuse.c
@@ -1162,7 +1162,7 @@ static int try_get_path2(struct fuse *f, fuse_ino_t nodeid1, const char *name1,
struct node *wn1 = wnode1 ? *wnode1 : NULL;
unlock_path(f, nodeid1, wn1, NULL, ticket);
- free(path1);
+ free(*path1);
if (ticket && err != -EAGAIN)
release_tickets(f, nodeid1, wn1, ticket);
}