diff options
| author | Rodrigo Arias Mallo <rodarima@gmail.com> | 2024-06-12 21:19:46 +0200 |
|---|---|---|
| committer | Rodrigo Arias Mallo <rodarima@gmail.com> | 2024-06-12 21:25:35 +0200 |
| commit | 5db6c990b93262ab78879bc7c8221a97eb8626cd (patch) | |
| tree | 59f659b04ae94ae346b8f98f0f680bd8cd198588 | |
| parent | fd120fb9b09ddd584ff9bf41e9ca0d29c99dd7a0 (diff) | |
Fix segfault in Done button of downloads
The destructor was using a harcoded index to the elements to free from
the original array of arguments used to call the wget program. When the
user agent was introduced, the index of the elements that require free()
shifted, causing the free() call to operate on the constant string of
the user agent instead.
Rather than relying on the hardcoded index, two new pointers hold the
values of the strings that need to be free()'d in the destructor.
Further additions in the argument array won't cause more problems.
Reported-by: pastebin <pastebin@gmx.com>
Fixes: https://github.com/dillo-browser/dillo/issues/196
See: https://lists.mailman3.com/hyperkitty/list/dillo-dev@mailman3.com/message/IPWQYKTYTO5G2BH3UU5224FRUFWCVGSO/
| -rw-r--r-- | ChangeLog | 1 | ||||
| -rw-r--r-- | dpi/downloads.cc | 11 |
2 files changed, 7 insertions, 5 deletions
@@ -11,6 +11,7 @@ dillo-3.2.0 [Not released yet] +- Add new_tab_page option to open a custom new tab page. Patches: Alex, Rodrigo Arias Mallo +- Ignore empty page title for tab labels. + Fix segfault when clicking the "Done" button in downloads dialog. Patches: Rodrigo Arias Mallo dillo-3.1.1 [Jun 8, 2024] diff --git a/dpi/downloads.cc b/dpi/downloads.cc index 303bf231..90f7b76d 100644 --- a/dpi/downloads.cc +++ b/dpi/downloads.cc @@ -99,6 +99,8 @@ class DLItem { pid_t mPid; int LogPipe[2]; char *shortname, *fullname; + char *esc_url; + char *cookies_path; char *target_dir; size_t log_len, log_max; int log_state; @@ -286,7 +288,6 @@ DLItem::DLItem(const char *full_filename, const char *url) { struct stat ss; const char *p; - char *esc_url; if (pipe(LogPipe) < 0) { MSG("pipe, %s\n", dStrerror(errno)); @@ -320,6 +321,7 @@ DLItem::DLItem(const char *full_filename, const char *url) /* avoid malicious SMTP relaying with FTP urls */ if (dStrnAsciiCasecmp(esc_url, "ftp:/", 5) == 0) Filter_smtp_hack(esc_url); + cookies_path = dStrconcat(dGethomedir(), "/.dillo/cookies.txt", NULL); dl_argv = new char*[10]; int i = 0; const char *user_agent = "Dillo/" VERSION; @@ -330,7 +332,7 @@ DLItem::DLItem(const char *full_filename, const char *url) dl_argv[i++] = (char*) user_agent; dl_argv[i++] = (char*)"-c"; dl_argv[i++] = (char*)"--load-cookies"; - dl_argv[i++] = dStrconcat(dGethomedir(), "/.dillo/cookies.txt", NULL); + dl_argv[i++] = cookies_path; dl_argv[i++] = (char*)"-O"; dl_argv[i++] = fullname; dl_argv[i++] = esc_url; @@ -432,9 +434,8 @@ DLItem::~DLItem() dFree(fullname); dFree(target_dir); free(log_text); - int idx = (strcmp(dl_argv[1], "-c")) ? 2 : 3; - dFree(dl_argv[idx]); - dFree(dl_argv[idx+3]); + dFree(esc_url); + dFree(cookies_path); delete [] dl_argv; delete(group); |