From d56e6a11e983b4dba8804af94848f249685247e3 Mon Sep 17 00:00:00 2001
From: oga
Date: Tue, 8 Apr 2008 17:38:27 +0000
Subject: No cookie for okan.

fix use-after-free that broke exec's path getting stuff.

``paths'' isn't used anymore, but pointers to within that array are still
used in the next loop. delay freeing it until after then.
---
 kbfunc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'kbfunc.c')

diff --git a/kbfunc.c b/kbfunc.c
index 124a85a..954f703 100644
--- a/kbfunc.c
+++ b/kbfunc.c
@@ -15,7 +15,7 @@
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  *
- * $Id: kbfunc.c,v 1.18 2008/04/07 23:47:09 simon Exp $
+ * $Id: kbfunc.c,v 1.19 2008/04/08 17:38:27 oga Exp $
  */
 
 #include <paths.h>
@@ -307,7 +307,6 @@ kbfunc_exec(struct client_ctx *scratch, void *arg)
 			ap++;
 	}
 	*ap = NULL;
-	xfree(path);
 	for (i = 0; i < NPATHS && paths[i] != NULL; i++) {
 		if ((dirp = opendir(paths[i])) == NULL)
 			continue;
@@ -351,6 +350,7 @@ kbfunc_exec(struct client_ctx *scratch, void *arg)
 		}
 		(void) closedir(dirp);
 	}
+	xfree(path);
 
 	if ((mi = search_start(&menuq,
 		    search_match_exec, NULL, label, 1)) != NULL) {
-- 
cgit v1.2.3-2-gb3c3