From cb524c2fde48134f18292fbf8483f4043f9e6379 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Tue, 10 Sep 2013 11:02:00 -0500 Subject: [PATCH] binpac: Fix two use-after-free bugs. --- tools/binpac/lib/binpac_exception.h | 2 +- tools/binpac/src/pac_field.cc | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/tools/binpac/lib/binpac_exception.h b/tools/binpac/lib/binpac_exception.h index 3feda3d69d..6debf54466 100644 --- a/tools/binpac/lib/binpac_exception.h +++ b/tools/binpac/lib/binpac_exception.h @@ -16,7 +16,7 @@ public: void append(string m) { msg_ += m; } string msg() const { return msg_; } - const char* c_msg() const { return msg().c_str(); } + const char* c_msg() const { return msg_.c_str(); } protected: string msg_; diff --git a/tools/binpac/src/pac_field.cc b/tools/binpac/src/pac_field.cc index 0ee70e4b28..7b7b337b1a 100644 --- a/tools/binpac/src/pac_field.cc +++ b/tools/binpac/src/pac_field.cc @@ -23,6 +23,8 @@ Field::~Field() void Field::AddAttr(AttrList* attrs) { + bool delete_attrs = false; + if ( ! attrs_ ) { attrs_ = attrs; @@ -30,11 +32,14 @@ void Field::AddAttr(AttrList* attrs) else { attrs_->insert(attrs_->end(), attrs->begin(), attrs->end()); - delete attrs; + delete_attrs = true; } foreach(i, AttrList, attrs) ProcessAttr(*i); + + if ( delete_attrs ) + delete attrs; } void Field::ProcessAttr(Attr *a)