Aren/haiku
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Installer: Fix use-after-free of target directory name.

Browse Source 
When CopyEngine::_CopyFolder() would recursively call itself, the
fCurrentTargetFolder would be set to the entry name of that directory.
When this returned, this was never reset to the parent directory name
and would eventually use a freed string when the BEntry was reused
for the next entry.
This commit is contained in:
Michael Lotz 2019-01-03 13:59:42 +01:00
parent f10faf61ac
commit 6990ae7b84
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/apps/installer/CopyEngine.cpp
View File

@ -286,7 +286,6 @@ CopyEngine::_CopyFolder(const char* _source, const char* _destination,
int32& level, sem_id cancelSemaphore) int32& level, sem_id cancelSemaphore)
{ {
level++; level++;
fCurrentTargetFolder = _destination;
BDirectory source(_source); BDirectory source(_source);
status_t ret = source.InitCheck(); status_t ret = source.InitCheck();
@ -332,6 +331,7 @@ CopyEngine::_CopyFolder(const char* _source, const char* _destination,
fItemsCopied++; fItemsCopied++;
fCurrentItem = name; fCurrentItem = name;
fCurrentTargetFolder = _destination;
_UpdateProgress(); _UpdateProgress();
BEntry copy(&destination, name); BEntry copy(&destination, name);