Skip to content

recode.c: fix double free in recode_format_table - #74

Merged
rrthomas merged 1 commit into
rrthomas:masterfrom
prownd:recode.c-fix-double-free-in-recode_format_table-s01
Sep 23, 2026
Merged

rrthomas merged 1 commit into
rrthomas:masterfrom
prownd:recode.c-fix-double-free-in-recode_format_table-s01

Conversation

@prownd

@prownd prownd commented Sep 21, 2026

Copy link
Copy Markdown

When no table name was given, recode_format_table used the string returned by recode_edit_sequence as the table name, modified it in place, and freed it. That string is the request's own work_string, which recode_delete_request frees again later:

request = recode_new_request (outer);
request->make_header_flag = true;
recode_scan_request (request, "latin1..ibmpc");
recode_format_table (request, RECODE_LANGUAGE_C, NULL);
recode_delete_request (request); /* double free */

Always work on a copy of the name.

When no table name was given, recode_format_table used the string
returned by recode_edit_sequence as the table name, modified it in
place, and freed it.  That string is the request's own work_string,
which recode_delete_request frees again later:

  request = recode_new_request (outer);
  request->make_header_flag = true;
  recode_scan_request (request, "latin1..ibmpc");
  recode_format_table (request, RECODE_LANGUAGE_C, NULL);
  recode_delete_request (request);          /* double free */

Always work on a copy of the name.
@rrthomas

Copy link
Copy Markdown
Owner

Many thanks for this and your other PRs.

@rrthomas
rrthomas merged commit ab66b30 into rrthomas:master Sep 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants