comparison lwlib/lw_expr.c @ 342:12e2453f8417

Fix potential memory access after free in lw_expr_simplify_go() Thanks to Erik Gavriluk (erik@bombfactory.com) for spotting a missing "else" when attempting to resolve a "special" reference. This could have led to access to memory that had already been freed if a "special" resolved to an expression that also referenced the same special (a circular reference). Whether that can actually happen is questionable but the check must have been added for a reason so it follows that it should be done correctly. This also brings the code in line with similar code resolving symbol references which makes a similar check.
author William Astle <lost@l-w.ca>
date Sat, 14 Mar 2015 14:06:13 -0600
parents 6138e304ab9a
children 433dbc18fb41
comparison
equal deleted inserted replaced
341:48b1cc3991d8 342:12e2453f8417
575 lw_expr_t te; 575 lw_expr_t te;
576 576
577 te = evaluate_special(E -> value, E -> value2, priv); 577 te = evaluate_special(E -> value, E -> value2, priv);
578 if (lw_expr_contains(te, E)) 578 if (lw_expr_contains(te, E))
579 lw_expr_destroy(te); 579 lw_expr_destroy(te);
580 if (te) 580 else if (te)
581 { 581 {
582 for (o = E -> operands; o; o = o -> next) 582 for (o = E -> operands; o; o = o -> next)
583 lw_expr_destroy(o -> p); 583 lw_expr_destroy(o -> p);
584 if (E -> type == lw_expr_type_var) 584 if (E -> type == lw_expr_type_var)
585 lw_free(E -> value2); 585 lw_free(E -> value2);