[Lcd4linux-devel] Serious memory corruption in cfg.c

[Mattia Jona-L. <mat...@gm...>]

Hi!

I was having a look at the cfg_get routine and I found a segmentation
fault error.

char *cfg_get(const char *section, const char *key, const char *defval)
{
    char *expression;
    char *retval;
    void *tree = NULL;
    RESULT result = { 0, 0, 0, NULL };

    expression = cfg_lookup(section, key);

    if (expression != NULL) {
	if (*expression == '\0')
	    return "";
	if (Compile(expression, &tree) == 0 && Eval(tree, &result) == 0) {
	    retval = strdup(R2S(&result));
	    DelTree(tree);
	    DelResult(&result);
	    return (retval);
	}
	DelTree(tree);
	DelResult(&result);
    }
    if (defval)
	return strdup(defval);
    return NULL;
}

The return value is either a pointer to a string or NULL. But while it
is perfectly fine to call free(NULL), it is a segfault error to call
free("") since "" is returned as a constant string. So in the case of
*expression == '\0' one should have
return strdup("")     instead of return ""

Am I correct?

Bye!

Mattia