cf/cf_loop.c and share/put.c tried to read the next pointer in an element of a linked list after freeing the element. ud/ud_copy.c tried to read beyond the end of the _defs_ array: it only has _nrexpldefs_ elements, not _nrdefs_ elements. These bugs caused core dumps on OpenBSD. Its malloc() put _defs_ near the end of a page, so reading beyond the end crossed into an unmapped page. Its free() wrote junk bytes and changed the next pointer to 0xdfdfdfdfdfdfdfdf. |
||
|---|---|---|
| .. | ||
| bo | ||
| ca | ||
| cf | ||
| cj | ||
| cs | ||
| descr | ||
| em_ego | ||
| ic | ||
| il | ||
| lv | ||
| ra | ||
| share | ||
| sp | ||
| sr | ||
| ud | ||
| Action | ||
| build.lua | ||