[master] e06e3bc Fix use-after-free

Federico G. Schwindt fgsch at lodoss.net
Fri Dec 15 18:44:04 UTC 2017


commit e06e3bc7c7e35e008a6f2f101cfd1c10cb0a5093
Author: Federico G. Schwindt <fgsch at lodoss.net>
Date:   Fri Dec 15 18:30:28 2017 +0000

    Fix use-after-free
    
    Spotted by ASAN.

diff --git a/lib/libvcc/vcc_expr.c b/lib/libvcc/vcc_expr.c
index 742ca21..affbe68 100644
--- a/lib/libvcc/vcc_expr.c
+++ b/lib/libvcc/vcc_expr.c
@@ -843,7 +843,7 @@ vcc_expr_add(struct vcc *tl, struct expr **e, vcc_type_t fmt)
 	const struct adds *ap;
 	struct expr  *e2;
 	struct token *tk;
-	int n;
+	int lit, n;
 
 	*e = NULL;
 	vcc_expr_mul(tl, e, fmt);
@@ -877,10 +877,11 @@ vcc_expr_add(struct vcc *tl, struct expr **e, vcc_type_t fmt)
 			if (e2->fmt != STRINGS)
 				vcc_expr_tostring(tl, &e2, STRINGS);
 			if (vcc_islit(*e) && vcc_isconst(e2)) {
+				lit = vcc_islit(e2);
 				*e = vcc_expr_edit(tl, STRINGS,
 				    "\v1\n\v2", *e, e2);
 				(*e)->constant = EXPR_CONST;
-				if (vcc_islit(e2))
+				if (lit)
 					(*e)->constant |= EXPR_STR_CONST;
 			} else {
 				n = (*e)->nstr + e2->nstr;


More information about the varnish-commit mailing list