use buf before passing it to realloc (gcc 12 -Wuse-after-free)
authorMichael Gilbert <mgilbert@debian.org>
Wed, 6 Jul 2022 00:44:32 +0000 (01:44 +0100)
committerMichael Gilbert <mgilbert@debian.org>
Wed, 6 Jul 2022 00:44:32 +0000 (01:44 +0100)
Gbp-Pq: Topic warnings
Gbp-Pq: Name use-after-free.patch

server/queue.c

index 4f69a082b74ed97869d3bdb6be4c0696f36c6a30..a9aa95543db0179dac8485f64205ef89a6ad50f6 100644 (file)
@@ -3334,13 +3334,15 @@ DECL_HANDLER(get_rawinput_buffer)
         if (cur + data->size > buf + get_reply_max_size()) break;
         if (cur + data->size > buf + buf_size)
         {
+            ptrdiff_t diff = cur - buf;
+
             buf_size += buf_size / 2 + extra_size;
             if (!(tmp = realloc( buf, buf_size )))
             {
                 set_error( STATUS_NO_MEMORY );
                 return;
             }
-            cur = tmp + (cur - buf);
+            cur = tmp + diff;
             buf = tmp;
         }