summary refs log tree commit diff
diff options
context:
space:
mode:
authorKamil Dudka <kdudka@redhat.com>2018-11-07 14:04:55 +0100
committerPeter Stephenson <p.stephenson@samsung.com>2018-11-09 11:04:06 +0000
commite27175c7c8cdfeb4e28d4ff21eb51aa003d70a03 (patch)
tree4e710ed941870e0dacd77e273db952fb9bf3b667
parentd1095bdf744c190c7e8ff126ba02caea8f63880d (diff)
downloadzsh-e27175c7c8cdfeb4e28d4ff21eb51aa003d70a03.tar.gz
zsh-e27175c7c8cdfeb4e28d4ff21eb51aa003d70a03.tar.xz
zsh-e27175c7c8cdfeb4e28d4ff21eb51aa003d70a03.zip
43789: possible use after free clearing up math func from module
-rw-r--r--ChangeLog3
-rw-r--r--Src/module.c2
2 files changed, 3 insertions, 2 deletions
diff --git a/ChangeLog b/ChangeLog
index 009c33e30..343038997 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 2018-11-09  Peter Stephenson  <p.stephenson@samsung.com>
 
+	* 43789: Kamil: Src/module.c: possible use after free handling
+	math functions from module.
+
 	* 43792: Kamil: Src/exec.c: file descriptor could leak on fork error.
 
 	* 43793: Kamil: Src/Zle/computil.c: could overrun buffer by 1 byte.
diff --git a/Src/module.c b/Src/module.c
index 4ae78310f..33d75ebbd 100644
--- a/Src/module.c
+++ b/Src/module.c
@@ -1390,8 +1390,6 @@ setmathfuncs(char const *nam, MathFunc f, int size, int *e)
 	    if (deletemathfunc(f)) {
 		zwarnnam(nam, "math function `%s' already deleted", f->name);
 		ret = 1;
-	    } else {
-		f->flags &= ~MFF_ADDED;
 	    }
 	}
 	f++;