diff options
| author | Corinna Vinschen <corinna@vinschen.de> | 2013-11-19 11:48:02 +0000 |
|---|---|---|
| committer | Corinna Vinschen <corinna@vinschen.de> | 2013-11-19 11:48:02 +0000 |
| commit | ff125797e38c9628ae1308973231660a22563309 (patch) | |
| tree | 2056862e6bca5df3c210eeb7224e730b0e00e9a4 /newlib | |
| parent | 700a3783ee4912e1000347bcde2116863507fbbd (diff) | |
| download | cygnal-ff125797e38c9628ae1308973231660a22563309.tar.gz cygnal-ff125797e38c9628ae1308973231660a22563309.tar.bz2 cygnal-ff125797e38c9628ae1308973231660a22563309.zip | |
* libc/posix/closedir.c: Fix use after free.
Remove useless test dd_fd != -1
* libc/posix/readdir.c: Remove useless test dd_fd == -1
* libc/posix/readdir_r.c: Ditto.
Diffstat (limited to 'newlib')
| -rw-r--r-- | newlib/ChangeLog | 7 | ||||
| -rw-r--r-- | newlib/libc/posix/closedir.c | 16 | ||||
| -rw-r--r-- | newlib/libc/posix/readdir.c | 3 | ||||
| -rw-r--r-- | newlib/libc/posix/readdir_r.c | 5 |
4 files changed, 12 insertions, 19 deletions
diff --git a/newlib/ChangeLog b/newlib/ChangeLog index dc1b1e7fb..16e648df3 100644 --- a/newlib/ChangeLog +++ b/newlib/ChangeLog @@ -1,3 +1,10 @@ +2013-11-19 Terraneo Federico <fede.tft@hotmail.it> + + * libc/posix/closedir.c: Fix use after free. + Remove useless test dd_fd != -1 + * libc/posix/readdir.c: Remove useless test dd_fd == -1 + * libc/posix/readdir_r.c: Ditto. + 2013-11-18 Sahil Patnayakuni <sahilp@oarcorp.com> * libc/include/stdio.h, libc/machine/powerpc/vfscanf.c, diff --git a/newlib/libc/posix/closedir.c b/newlib/libc/posix/closedir.c index 634f5ad12..7801da043 100644 --- a/newlib/libc/posix/closedir.c +++ b/newlib/libc/posix/closedir.c @@ -52,25 +52,19 @@ int _DEFUN(closedir, (dirp), register DIR *dirp) { - int fd, rc; + int rc; #ifdef HAVE_DD_LOCK __lock_acquire_recursive(dirp->dd_lock); #endif - rc = 0; - fd = dirp->dd_fd; - if (fd != -1) { - dirp->dd_fd = -1; - dirp->dd_loc = 0; - (void)free((void *)dirp->dd_buf); - (void)free((void *)dirp); - rc = close(fd); - _cleanupdir(dirp); - } + rc = close(dirp->dd_fd); + _cleanupdir(dirp); + free((void *)dirp->dd_buf); #ifdef HAVE_DD_LOCK __lock_release_recursive(dirp->dd_lock); __lock_close_recursive(dirp->dd_lock); #endif + free((void *)dirp); return rc; } diff --git a/newlib/libc/posix/readdir.c b/newlib/libc/posix/readdir.c index d3187e603..3e620e328 100644 --- a/newlib/libc/posix/readdir.c +++ b/newlib/libc/posix/readdir.c @@ -53,9 +53,6 @@ _DEFUN(readdir, (dirp), #ifdef HAVE_DD_LOCK __lock_acquire_recursive(dirp->dd_lock); #endif - - if (dirp->dd_fd == -1) - return NULL; for (;;) { if (dirp->dd_loc == 0) { diff --git a/newlib/libc/posix/readdir_r.c b/newlib/libc/posix/readdir_r.c index eafbeca6a..1d526e309 100644 --- a/newlib/libc/posix/readdir_r.c +++ b/newlib/libc/posix/readdir_r.c @@ -60,11 +60,6 @@ struct dirent *tmpdp; #ifdef HAVE_DD_LOCK __lock_acquire_recursive(dirp->dd_lock); #endif - - if (dirp->dd_fd == -1) { - *dpp = NULL; - return errno = EBADF; - } for (;;) { if (dirp->dd_loc == 0) { |