Commit 8b24df9f by Lars Immisch

Fixed a looming memory corruption bug.

malloc does not initialize the memory to zero, so

sass_context *ctx = sass_new_context()

will create a context with a random value in ctx->output_string.

If sass_free_context(ctx) was called immediately thereafter,
ctx->output_string would have a random value and the result of the
free(ctx->output_string) would be undefined.

In the worst case, this corrupts the heap and the process dies much much later.

Also, free isn't delete and mustn't be called with a NULL pointer.
parent f0f7765d
...@@ -13,26 +13,28 @@ extern "C" { ...@@ -13,26 +13,28 @@ extern "C" {
using namespace std; using namespace std;
sass_context* sass_new_context() sass_context* sass_new_context()
{ return (sass_context*) malloc(sizeof(sass_context)); } { return (sass_context*) calloc(1, sizeof(sass_context)); }
void sass_free_context(sass_context* ctx) void sass_free_context(sass_context* ctx)
{ {
free(ctx->output_string); if (ctx->output_string)
free(ctx->output_string);
free(ctx); free(ctx);
} }
sass_file_context* sass_new_file_context() sass_file_context* sass_new_file_context()
{ return (sass_file_context*) malloc(sizeof(sass_file_context)); } { return (sass_file_context*) calloc(1, sizeof(sass_file_context)); }
void sass_free_file_context(sass_file_context* ctx) void sass_free_file_context(sass_file_context* ctx)
{ {
free(ctx->output_string); if (ctx->output_string)
free(ctx->output_string);
free(ctx); free(ctx);
} }
sass_folder_context* sass_new_folder_context() sass_folder_context* sass_new_folder_context()
{ return (sass_folder_context*) malloc(sizeof(sass_folder_context)); } { return (sass_folder_context*) calloc(1, sizeof(sass_folder_context)); }
static char* process_document(Sass::Document& doc, int style) static char* process_document(Sass::Document& doc, int style)
{ {
using namespace Sass; using namespace Sass;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment