Hello, t...@.

A bit tricky code in yp_all.c `val' is not freed.  It might be
allocated but might be not freed
when `key' allocation failed.

Index: lib/libc/yp/yp_all.c
===================================================================
RCS file: /OpenBSD/src/lib/libc/yp/yp_all.c,v
retrieving revision 1.9
diff -u -r1.9 yp_all.c
--- lib/libc/yp/yp_all.c        5 Aug 2005 13:02:16 -0000       1.9
+++ lib/libc/yp/yp_all.c        8 Jan 2010 12:37:25 -0000
@@ -78,8 +78,11 @@
                        }
                        xdr_free(xdr_ypresp_all, (char *)&out);

-                       if (key == NULL || val == NULL)
+                       if (key == NULL || val == NULL) {
+                               if (val != NULL)
+                                       free(val);
                                return FALSE;
+                       }

                        r = (*ypresp_allfn)(status, key,
                            out.ypresp_all_u.val.key.keydat_len, val,

Reply via email to