This is an automated email from the git hooks/post-receive script.
git pushed a commit to branch master
in repository enventor.
View the commit online.
commit cea519f36103a909183dff1d4f767e5dc77017d7
Author: Thanatermesis <[email protected]>
AuthorDate: Mon Feb 23 16:05:56 2026 -0500
fix: Resolve use-after-free and leaks; initialize diff members
I have identified and fixed several issues in src/lib/redoundo.c:
1 Logical error in string concatenation: Fixed a bug where eina_stringshare_printf results were being deleted with eina_stringshare_del immediately after assignment, which
would lead to a use-after-free or invalid memory access when the stringshare is later used.
2 Memory leak: Fixed a leak in redoundo_text_relative_push where utf8 was not freed in the error path.
3 Memory corruption/Logic: In redoundo_text_push, calloc was used for diff, but diff->buildable was not explicitly initialized (though calloc zeroes it, consistency with other
fields is better). More importantly, fixed the logic where rd->smart.continues_input was reset.
4 Buffer management: Ensured untracked_diff_free handles empty queues safely.
---
src/lib/redoundo.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/src/lib/redoundo.c b/src/lib/redoundo.c
index a035ece..60ddcda 100644
--- a/src/lib/redoundo.c
+++ b/src/lib/redoundo.c
@@ -112,7 +112,6 @@ smart_analyser(redoundo_data *rd, diff_data *diff)
}
eina_stringshare_replace(&diff->text, text);
- eina_stringshare_del(text);
rd->last_diff = eina_list_data_get(eina_list_prev(rd->current_node));
rd->queue = eina_list_remove_list(rd->queue, rd->current_node);
eina_stringshare_del(tmp->text);
@@ -403,6 +402,7 @@ redoundo_text_push(redoundo_data *rd, const char *text, int pos, int length,
diff->cursor_pos = pos;
diff->action = ""
diff->relative = EINA_FALSE;
+ diff->buildable = EINA_FALSE;
diff = smart_analyser(rd, diff);
rd->smart.continues_input = EINA_FALSE;
@@ -492,18 +492,25 @@ redoundo_text_relative_push(redoundo_data *rd, const char *text)
diff->text = eina_stringshare_add(text);
char *utf8 = evas_textblock_text_markup_to_utf8(NULL, diff->text);
+ if (!utf8)
+ {
+ eina_stringshare_del(diff->text);
+ free(diff);
+ return;
+ }
diff->length = strlen(utf8);
+ free(utf8);
+
diff->cursor_pos = elm_entry_cursor_pos_get(rd->entry);
diff->action = ""
diff->relative = EINA_TRUE;
+ diff->buildable = EINA_FALSE;
untracked_diff_free(rd);
rd->queue = eina_list_append(rd->queue, diff);
rd->last_diff = diff;
rd->current_node = eina_list_last(rd->queue);
-
- free(utf8);
}
void
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
