[master] e06e3bc Fix use-after-free
Federico G. Schwindt
fgsch at lodoss.net
Fri Dec 15 18:44:04 UTC 2017
commit e06e3bc7c7e35e008a6f2f101cfd1c10cb0a5093
Author: Federico G. Schwindt <fgsch at lodoss.net>
Date: Fri Dec 15 18:30:28 2017 +0000
Fix use-after-free
Spotted by ASAN.
diff --git a/lib/libvcc/vcc_expr.c b/lib/libvcc/vcc_expr.c
index 742ca21..affbe68 100644
--- a/lib/libvcc/vcc_expr.c
+++ b/lib/libvcc/vcc_expr.c
@@ -843,7 +843,7 @@ vcc_expr_add(struct vcc *tl, struct expr **e, vcc_type_t fmt)
const struct adds *ap;
struct expr *e2;
struct token *tk;
- int n;
+ int lit, n;
*e = NULL;
vcc_expr_mul(tl, e, fmt);
@@ -877,10 +877,11 @@ vcc_expr_add(struct vcc *tl, struct expr **e, vcc_type_t fmt)
if (e2->fmt != STRINGS)
vcc_expr_tostring(tl, &e2, STRINGS);
if (vcc_islit(*e) && vcc_isconst(e2)) {
+ lit = vcc_islit(e2);
*e = vcc_expr_edit(tl, STRINGS,
"\v1\n\v2", *e, e2);
(*e)->constant = EXPR_CONST;
- if (vcc_islit(e2))
+ if (lit)
(*e)->constant |= EXPR_STR_CONST;
} else {
n = (*e)->nstr + e2->nstr;
More information about the varnish-commit
mailing list