diff options
| author | Rodrigo Arias Mallo <rodarima@gmail.com> | 2024-06-12 21:19:46 +0200 |
|---|---|---|
| committer | Rodrigo Arias Mallo <rodarima@gmail.com> | 2024-06-12 21:25:35 +0200 |
| commit | 5db6c990b93262ab78879bc7c8221a97eb8626cd (patch) | |
| tree | 59f659b04ae94ae346b8f98f0f680bd8cd198588 /dpi | |
| parent | fd120fb9b09ddd584ff9bf41e9ca0d29c99dd7a0 (diff) | |
Fix segfault in Done button of downloads
The destructor was using a harcoded index to the elements to free from
the original array of arguments used to call the wget program. When the
user agent was introduced, the index of the elements that require free()
shifted, causing the free() call to operate on the constant string of
the user agent instead.
Rather than relying on the hardcoded index, two new pointers hold the
values of the strings that need to be free()'d in the destructor.
Further additions in the argument array won't cause more problems.
Reported-by: pastebin <pastebin@gmx.com>
Fixes: https://github.com/dillo-browser/dillo/issues/196
See: https://lists.mailman3.com/hyperkitty/list/dillo-dev@mailman3.com/message/IPWQYKTYTO5G2BH3UU5224FRUFWCVGSO/
Diffstat (limited to 'dpi')
| -rw-r--r-- | dpi/downloads.cc | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/dpi/downloads.cc b/dpi/downloads.cc index 303bf231..90f7b76d 100644 --- a/dpi/downloads.cc +++ b/dpi/downloads.cc @@ -99,6 +99,8 @@ class DLItem { pid_t mPid; int LogPipe[2]; char *shortname, *fullname; + char *esc_url; + char *cookies_path; char *target_dir; size_t log_len, log_max; int log_state; @@ -286,7 +288,6 @@ DLItem::DLItem(const char *full_filename, const char *url) { struct stat ss; const char *p; - char *esc_url; if (pipe(LogPipe) < 0) { MSG("pipe, %s\n", dStrerror(errno)); @@ -320,6 +321,7 @@ DLItem::DLItem(const char *full_filename, const char *url) /* avoid malicious SMTP relaying with FTP urls */ if (dStrnAsciiCasecmp(esc_url, "ftp:/", 5) == 0) Filter_smtp_hack(esc_url); + cookies_path = dStrconcat(dGethomedir(), "/.dillo/cookies.txt", NULL); dl_argv = new char*[10]; int i = 0; const char *user_agent = "Dillo/" VERSION; @@ -330,7 +332,7 @@ DLItem::DLItem(const char *full_filename, const char *url) dl_argv[i++] = (char*) user_agent; dl_argv[i++] = (char*)"-c"; dl_argv[i++] = (char*)"--load-cookies"; - dl_argv[i++] = dStrconcat(dGethomedir(), "/.dillo/cookies.txt", NULL); + dl_argv[i++] = cookies_path; dl_argv[i++] = (char*)"-O"; dl_argv[i++] = fullname; dl_argv[i++] = esc_url; @@ -432,9 +434,8 @@ DLItem::~DLItem() dFree(fullname); dFree(target_dir); free(log_text); - int idx = (strcmp(dl_argv[1], "-c")) ? 2 : 3; - dFree(dl_argv[idx]); - dFree(dl_argv[idx+3]); + dFree(esc_url); + dFree(cookies_path); delete [] dl_argv; delete(group); |