diff --git a/winsup/cygwin/ChangeLog b/winsup/cygwin/ChangeLog index 784013787..908b71cc6 100644 --- a/winsup/cygwin/ChangeLog +++ b/winsup/cygwin/ChangeLog @@ -1,3 +1,10 @@ +2013-10-25 Corinna Vinschen + + * fhandler_clipboard.cc (fhandler_dev_clipboard::open): Drop gratuitios + handling of membuffer. It's NULL anyway. + (fhandler_dev_clipboard::lseek): Set membuffer to NULL after freeing + it to avoid subsequent crashes when accessing invalid pointer. + 2013-10-25 Corinna Vinschen * devices.in (dev_storage): Map /dev/random and /dev/urandom to diff --git a/winsup/cygwin/fhandler_clipboard.cc b/winsup/cygwin/fhandler_clipboard.cc index db72b9787..ad5304f0b 100644 --- a/winsup/cygwin/fhandler_clipboard.cc +++ b/winsup/cygwin/fhandler_clipboard.cc @@ -69,9 +69,6 @@ fhandler_dev_clipboard::open (int flags, mode_t) { set_flags (flags | O_TEXT); pos = 0; - if (membuffer) - free (membuffer); - membuffer = NULL; if (!cygnativeformat) cygnativeformat = RegisterClipboardFormatW (CYGWIN_NATIVE); nohandle (true); @@ -336,7 +333,10 @@ fhandler_dev_clipboard::lseek (off_t offset, int whence) pos = offset; /* treat seek like rewind */ if (membuffer) - free (membuffer); + { + free (membuffer); + membuffer = NULL; + } msize = 0; return 0; } diff --git a/winsup/cygwin/release/1.7.26 b/winsup/cygwin/release/1.7.26 index ca0170bbd..1da677bd0 100644 --- a/winsup/cygwin/release/1.7.26 +++ b/winsup/cygwin/release/1.7.26 @@ -26,3 +26,5 @@ Bug fixes: - Properly set process sid rather than always using -1. Fixes: http://cygwin.com/ml/cygwin/2013-10/threads.html#00237 + +- Fix a potential crash after calling lseek on /dev/clipboard.