code: drawterm

Info  •  Files  •  Log

dangling pointer reference (Tim Wiess)

--- a/kern/devmnt.c

+++ b/kern/devmnt.c

@@ -220,9 +220,6 @@

 	m->msize = f.msize;

 	unlock(&mntalloc.lk);

-	poperror();	/* msg */

-	free(msg);

-

 	lock(&m->lk);

 	m->queue = 0;

 	m->rip = 0;

@@ -232,16 +229,19 @@

 	m->c = c;

 	unlock(&m->lk);

+	poperror();	/* msg */

 	poperror();	/* c */

 	qunlock(&c->umqlock);

 	k = strlen(f.version);

 	if(returnlen > 0){

-		if(returnlen < k)

+		if(returnlen < k){

+			free(msg);

 			error(Eshort);

+		}

 		memmove(version, f.version, k);

 	}

-

+	free(msg);

 	return k;

 }