summary refs log tree commit diff
diff options
context:
space:
mode:
authorMartin Sebor <msebor@redhat.com>2022-01-25 17:39:02 -0700
committerMartin Sebor <msebor@redhat.com>2022-01-25 17:39:02 -0700
commitee52ab25ba875f458981fce22c54e3c04c7a17d3 (patch)
tree11e5bf82771d6b903d0385501d55ee7c8a8071b3
parent7845064d2d5a50e347ee9f4b78ec5e6316190154 (diff)
downloadglibc-ee52ab25ba875f458981fce22c54e3c04c7a17d3.tar.gz
glibc-ee52ab25ba875f458981fce22c54e3c04c7a17d3.tar.xz
glibc-ee52ab25ba875f458981fce22c54e3c04c7a17d3.zip
io: Fix use-after-free in ftw [BZ #26779]
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
-rw-r--r--io/ftw.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/io/ftw.c b/io/ftw.c
index 2742541f36..94bd5a93e4 100644
--- a/io/ftw.c
+++ b/io/ftw.c
@@ -323,8 +323,9 @@ open_dir_stream (int *dfdp, struct ftw_data *data, struct dir_data *dirp)
 	  buf[actsize++] = '\0';
 
 	  /* Shrink the buffer to what we actually need.  */
-	  data->dirstreams[data->actdir]->content = realloc (buf, actsize);
-	  if (data->dirstreams[data->actdir]->content == NULL)
+	  void *content = realloc (buf, actsize);
+	  data->dirstreams[data->actdir]->content = content;
+	  if (content == NULL)
 	    {
 	      int save_err = errno;
 	      free (buf);