base/SOURCES/autofs-5.1.3-fix-possible-memory-leak-during-amd-parse.patch

autofs-5.1.3 - fix possible memory leak during amd parse

From: Ian Kent <raven@themaw.net>

If an amd map entry option is given more than once subsequent assignment
could result in a memory leak.

Signed-off-by: Ian Kent <raven@themaw.net>
---
 CHANGELOG           |    1 
 modules/amd_parse.y |   92 +++++++++++++++++++++++++++++-----------------------
 2 files changed, 54 insertions(+), 39 deletions(-)

--- autofs-5.0.7.orig/CHANGELOG
+++ autofs-5.0.7/CHANGELOG
@@ -276,6 +276,7 @@
 - refactor amd_parse.c.
 - fix amd parser double quote handling.
 - fix expandamdent() quote handling.
+- fix possible memory leak during amd parse.
 
 25/07/2012 autofs-5.0.7
 =======================
--- autofs-5.0.7.orig/modules/amd_parse.y
+++ autofs-5.0.7/modules/amd_parse.y
@@ -41,6 +41,7 @@ extern int amd_lex(void);
 extern void amd_set_scan_buffer(const char *);
 
 static char *amd_strdup(char *);
+static void amd_set_value(char **, char *);
 static void local_init_vars(void);
 static void local_free_vars(void);
 
@@ -289,19 +290,22 @@ option_assignment: MAP_OPTION OPTION_ASS
 			}
 
 			if (!strcmp($1, "fs"))
-				entry.fs = fs_opt_val;
+				amd_set_value(&entry.fs, fs_opt_val);
 			else if (!strcmp($1, "sublink")) {
-				entry.sublink = fs_opt_val;
+				amd_set_value(&entry.sublink, fs_opt_val);
 			} else if (!strcmp($1, "pref")) {
 				if (strcmp(fs_opt_val, "null"))
-					entry.pref = fs_opt_val;
+					amd_set_value(&entry.pref, fs_opt_val);
 				else {
-					entry.pref = amd_strdup("");
-					if (!entry.pref) {
+					char *empty;
+
+					empty = amd_strdup("");
+					if (!empty) {
 						amd_notify($3);
 						free(fs_opt_val);
 						YYABORT;
 					}
+					amd_set_value(&entry.pref, empty);
 					free(fs_opt_val);
 				}
 			} else {
@@ -314,11 +318,14 @@ option_assignment: MAP_OPTION OPTION_ASS
 	| MAP_OPTION OPTION_ASSIGN
 	{
 		if (!strcmp($1, "fs")) {
-			entry.fs = amd_strdup("");
-			if (!entry.fs) {
+			char *empty;
+
+			empty = amd_strdup("");
+			if (!empty) {
 				amd_notify($1);
 				YYABORT;
 			}
+			amd_set_value(&entry.fs, empty);
 		} else {
 			amd_notify($1);
 			YYABORT;
@@ -335,11 +342,11 @@ option_assignment: MAP_OPTION OPTION_ASS
 		}
 
 		if (!strcmp($1, "rhost"))
-			entry.rhost = fs_opt_val;
+			amd_set_value(&entry.rhost, fs_opt_val);
 		else if (!strcmp($1, "rfs"))
-			entry.rfs = fs_opt_val;
+			amd_set_value(&entry.rfs, fs_opt_val);
 		else if (!strcmp($1, "dev"))
-			entry.dev = fs_opt_val;
+			amd_set_value(&entry.dev, fs_opt_val);
 		else if (!strcmp($1, "mount") ||
 			 !strcmp($1, "unmount") ||
 			 !strcmp($1, "umount")) {
@@ -369,11 +376,11 @@ option_assignment: MAP_OPTION OPTION_ASS
 		}
 
 		if (!strcmp($1, "rhost"))
-			entry.rhost = empty;
+			amd_set_value(&entry.rhost, empty);
 		else if (!strcmp($1, "rfs"))
-			entry.rfs = empty;
+			amd_set_value(&entry.rfs, empty);
 		else if (!strcmp($1, "dev"))
-			entry.dev = empty;
+			amd_set_value(&entry.dev, empty);
 		else {
 			amd_notify($1);
 			free(empty);
@@ -468,36 +475,27 @@ static int match_map_option_fs_type(char
 		return 0;
 	}
 
-	if (!strcmp(fs_type, "auto")) {
+	if (!strcmp(fs_type, "auto"))
 		entry.flags |= AMD_MOUNT_TYPE_AUTO;
-		entry.type = fs_type;
-	} else if (!strcmp(fs_type, "nfs") ||
-		   !strcmp(fs_type, "nfs4")) {
+	else if (!strcmp(fs_type, "nfs") ||
+		 !strcmp(fs_type, "nfs4"))
 		entry.flags |= AMD_MOUNT_TYPE_NFS;
-		entry.type = fs_type;
-	} else if (!strcmp(fs_type, "nfsl")) {
+	else if (!strcmp(fs_type, "nfsl"))
 		entry.flags |= AMD_MOUNT_TYPE_NFSL;
-		entry.type = fs_type;
-	} else if (!strcmp(fs_type, "link")) {
+	else if (!strcmp(fs_type, "link"))
 		entry.flags |= AMD_MOUNT_TYPE_LINK;
-		entry.type = fs_type;
-	} else if (!strcmp(fs_type, "linkx")) {
+	else if (!strcmp(fs_type, "linkx"))
 		entry.flags |= AMD_MOUNT_TYPE_LINKX;
-		entry.type = fs_type;
-	} else if (!strcmp(fs_type, "host")) {
+	else if (!strcmp(fs_type, "host"))
 		entry.flags |= AMD_MOUNT_TYPE_HOST;
-		entry.type = fs_type;
-	} else if (!strcmp(fs_type, "lofs")) {
+	else if (!strcmp(fs_type, "lofs"))
 		entry.flags |= AMD_MOUNT_TYPE_LOFS;
-		entry.type = fs_type;
-	} else if (!strcmp(fs_type, "xfs")) {
+	else if (!strcmp(fs_type, "xfs"))
 		entry.flags |= AMD_MOUNT_TYPE_XFS;
-		entry.type = fs_type;
-	} else if (!strcmp(fs_type, "ext2") ||
+	else if (!strcmp(fs_type, "ext2") ||
 		   !strcmp(fs_type, "ext3") ||
-		   !strcmp(fs_type, "ext4")) {
+		   !strcmp(fs_type, "ext4"))
 		entry.flags |= AMD_MOUNT_TYPE_EXT;
-		entry.type = fs_type;
 	} else if (!strcmp(fs_type, "ufs")) {
 		entry.flags |= AMD_MOUNT_TYPE_UFS;
 		entry.type = conf_amd_get_linux_ufs_mount_type();
@@ -508,6 +506,7 @@ static int match_map_option_fs_type(char
 			return 0;
 		}
 		free(fs_type);
+		fs_type = NULL;
 	} else if (!strcmp(fs_type, "cdfs")) {
 		entry.flags |= AMD_MOUNT_TYPE_CDFS;
 		entry.type = amd_strdup("iso9660");
@@ -518,6 +517,7 @@ static int match_map_option_fs_type(char
 			return 0;
 		}
 		free(fs_type);
+		fs_type = NULL;
 	} else if (!strcmp(fs_type, "jfs") ||
 		   !strcmp(fs_type, "nfsx") ||
 		   !strcmp(fs_type, "program") ||
@@ -534,12 +534,16 @@ static int match_map_option_fs_type(char
 				 fs_type);
 		amd_msg(msg_buf);
 		free(fs_type);
+		fs_type = NULL;
 	} else {
 		amd_notify(fs_type);
 		free(fs_type);
 		return 0;
 	}
 
+	if (fs_type)
+		amd_set_value(&entry.type, fs_type);
+
 	return 1;
 }
 
@@ -558,15 +562,18 @@ static int match_map_option_map_type(cha
 	    !strcmp(map_type, "nisplus") ||
 	    !strcmp(map_type, "ldap") ||
 	    !strcmp(map_type, "hesiod")) {
-		entry.map_type = map_type;
+		amd_set_value(&entry.map_type, map_type);
 	} else if (!strcmp(map_type, "exec")) {
 		/* autofs uses "program" for "exec" map type */
-		entry.map_type = amd_strdup("program");
-		if (!entry.map_type) {
+		char * tmp;
+
+		tmp = amd_strdup("program");
+		if (!tmp) {
 			amd_notify(type);
 			free(map_type);
 			return 0;
 		}
+		amd_set_value(&entry.map_type, tmp);
 		free(map_type);
 	} else if (!strcmp(map_type, "passwd")) {
 		sprintf(msg_buf, "map type %s is "
@@ -621,17 +628,17 @@ static int match_mnt_option_options(char
 		tmp = amd_strdup(options);
 		if (!tmp)
 			return 0;
-		entry.opts = tmp;
+		amd_set_value(&entry.opts, tmp);
 	} else if (!strcmp(mnt_option, "addopts")) {
 		tmp = amd_strdup(options);
 		if (!tmp)
 			return 0;
-		entry.addopts = tmp;
+		amd_set_value(&entry.addopts, tmp);
 	} else if (!strcmp(mnt_option, "remopts")) {
 		tmp = amd_strdup(options);
 		if (!tmp)
 			return 0;
-		entry.remopts = tmp;
+		amd_set_value(&entry.remopts, tmp);
 	} else
 		return 0;
 
@@ -715,6 +722,13 @@ done:
 	return tmp;
 }
 
+static void amd_set_value(char **field, char *value)
+{
+	if (*field)
+		free(*field);
+	*field = value;
+}
+
 static int amd_error(const char *s)
 {
 	if (strcmp(s, "syntax"))