From ecc0459f763ea4f0294a9ba00e9050aba7fd3907 Mon Sep 17 00:00:00 2001 From: Brian Gianforcaro Date: Sun, 27 Mar 2022 15:48:16 -0700 Subject: [PATCH] LibC: Fix potential double free in ttyname_r_for_directory If we break out of the loop before we attempt to allocate again, then we double free the memory pointed to by `name_path`. Found by Static Analysis: Sonar Cloud --- Userland/Libraries/LibC/unistd.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/Userland/Libraries/LibC/unistd.cpp b/Userland/Libraries/LibC/unistd.cpp index c7caea4678..398c44e8f9 100644 --- a/Userland/Libraries/LibC/unistd.cpp +++ b/Userland/Libraries/LibC/unistd.cpp @@ -438,6 +438,7 @@ static int ttyname_r_for_directory(const char* directory_name, dev_t device_mode struct stat st; if (lstat(name_path, &st) < 0) { free(name_path); + name_path = nullptr; continue; }