cf/cf_loop.c and share/put.c tried to read the next pointer in an element of a linked list after freeing the element. ud/ud_copy.c tried to read beyond the end of the _defs_ array: it only has _nrexpldefs_ elements, not _nrdefs_ elements. These bugs caused core dumps on OpenBSD. Its malloc() put _defs_ near the end of a page, so reading beyond the end crossed into an unmapped page. Its free() wrote junk bytes and changed the next pointer to 0xdfdfdfdfdfdfdfdf. |
||
|---|---|---|
| .. | ||
| alloc.c | ||
| alloc.h | ||
| aux.c | ||
| aux.h | ||
| build.lua | ||
| cldefs.src | ||
| cset.c | ||
| cset.h | ||
| debug.c | ||
| debug.h | ||
| def.h | ||
| files.c | ||
| files.h | ||
| get.c | ||
| get.h | ||
| global.c | ||
| global.h | ||
| go.c | ||
| go.h | ||
| init_glob.c | ||
| init_glob.h | ||
| locals.c | ||
| locals.h | ||
| lset.c | ||
| lset.h | ||
| makecldef.c | ||
| Makefile | ||
| map.c | ||
| map.h | ||
| parser.c | ||
| parser.h | ||
| pop_push.awk | ||
| put.c | ||
| put.h | ||
| show.c | ||
| stack_chg.c | ||
| stack_chg.h | ||
| types.h | ||