unix: fix pointer ownership bug

libuv realloc'd a pointer that belonged to and was later freed by libev.
joyent · Sep 26, 2011 · 9673abe · 9673abe
1 parent f6a365e
commit 9673abe
Showing 1 changed file with 10 additions and 9 deletions.
diff --git a/src/unix/fs.c b/src/unix/fs.c
@@ -149,19 +149,20 @@ static int uv__fs_after(eio_req* eio) {
     case UV_FS_READLINK:
       if (req->result == -1) {
         req->ptr = NULL;
-      } else {
-        assert(req->result > 0);
-
-        if ((name = realloc(req->eio->ptr2, req->result + 1)) == NULL) {
-          /* Not enough memory. Reuse buffer, chop off last byte. */
-          name = req->eio->ptr2;
-          req->result--;
-        }
+        break;
+      }
+      assert(req->result > 0);
 
+      /* Make zero-terminated copy of req->eio->ptr2 */
+      if ((req->ptr = name = malloc(req->result + 1))) {
+        memcpy(name, req->eio->ptr2, req->result);
         name[req->result] = '\0';
-        req->ptr = name;
         req->result = 0;
       }
+      else {
+        req->errorno = ENOMEM;
+        req->result = -1;
+      }
       break;
 
     default: