From 75258d16c810bbcb42cf32de72b97031a930e2d3 Mon Sep 17 00:00:00 2001 From: hanjinpeng Date: Thu, 17 Sep 2026 02:26:56 -0400 Subject: [PATCH] recode.c: fix double free in recode_format_table When no table name was given, recode_format_table used the string returned by recode_edit_sequence as the table name, modified it in place, and freed it. That string is the request's own work_string, which recode_delete_request frees again later: request = recode_new_request (outer); request->make_header_flag = true; recode_scan_request (request, "latin1..ibmpc"); recode_format_table (request, RECODE_LANGUAGE_C, NULL); recode_delete_request (request); /* double free */ Always work on a copy of the name. --- src/recode.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/src/recode.c b/src/recode.c index fd7c44a..23b25a7 100644 --- a/src/recode.c +++ b/src/recode.c @@ -529,14 +529,13 @@ recode_format_table (RECODE_REQUEST request, /* Construct the name of the resulting table. */ - if (header_name) - { - if (!ALLOC (name, strlen (header_name) + 1, char)) - return false; - strcpy (name, header_name); - } - else - name = recode_edit_sequence (request, 0); + /* NAME is modified in place below, then freed: always work on a copy, + as recode_edit_sequence returns the request's own work string. */ + if (!header_name) + header_name = recode_edit_sequence (request, 0); + if (!ALLOC (name, strlen (header_name) + 1, char)) + return false; + strcpy (name, header_name); /* Ensure the table name contains only valid characters for a C identifier. */