Bug#659593: Info received (showstopper)

[Harald Dunkel]

PS: Attached you can find a patch to fix the problem in tac.
Actually it upgrades tac to the version found in coreutils 8.6.
Using this new version the double free() seems to be gone.


Hope this helps

Harri

#! /bin/sh /usr/share/dpatch/dpatch-run

@DPATCH@
--- coreutils-8.5/src/tac.c     2010-03-13 16:14:09.000000000 +0100
+++ coreutils-8.6/src/tac.c     2010-10-11 19:35:11.000000000 +0200
@@ -245,7 +245,7 @@
   if (sentinel_length)
     match_start -= match_length1;
 
-  for (;;)
+  while (true)
     {
       /* Search backward from `match_start' - 1 to `G_buffer' for a match
          with `separator'; for speed, use strncmp if `separator' contains no
@@ -633,7 +633,6 @@
   if (! (read_size < half_buffer_size && half_buffer_size < G_buffer_size))
     xalloc_die ();
   G_buffer = xmalloc (G_buffer_size);
-  void *buf = G_buffer;
   if (sentinel_length)
     {
       strcpy (G_buffer, separator);
@@ -666,6 +665,11 @@
       error (0, errno, "-");
       ok = false;
     }
-  free (buf);
+
+#ifdef lint
+  size_t offset = sentinel_length ? sentinel_length : 1;
+  free (G_buffer - offset);
+#endif
+
   exit (ok ? EXIT_SUCCESS : EXIT_FAILURE);
 }