From d8946406165ccfc458ff418aec465d67fa61ec1e Mon Sep 17 00:00:00 2001 From: Drazen Borkovic Date: Mon, 26 Oct 2015 22:22:54 -0700 Subject: When running rc on the following script, rc crashes. fn f1 { v=x { }} fn f2 { f1 1; f1 2 } f2 whatis Valgrind stack: ==10068== Invalid read of size 8 ==10068== at 0x40EFB1: varlookup (var.c:84) ==10068== by 0x407B04: whatare_all_vars (hash.c:311) ==10068== by 0x401E60: b_whatis (builtins.c:323) ==10068== by 0x402E32: exec (exec.c:92) ==10068== by 0x40F997: walk (walk.c:39) The reason is that vp[h].p is freed in delete_var(), but the pointer is kept. Later the pointer is found to be non-null and dereferenced causing the crash. --- hash.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hash.c b/hash.c index 5fafed2..6a176a4 100644 --- a/hash.c +++ b/hash.c @@ -195,6 +195,7 @@ extern void delete_var(char *s, bool stack) { } } else { /* needs to be removed from the hash table */ efree(v); + vp[h].p = NULL; efree(vp[h].name); if (vp[(h+1)&(vsize-1)].name == NULL) { --vused; -- cgit v1.2.3