xgettext: Fix double-free in singular/plural argument extraction

After commit 6aa7b7ed in 2009, xgettext assumed that ARGNUM1 and
ARGNUM2 of -k are different.  That could cause an double-free in
exceptional cases.
Reported by Johan Liljegren in:
<https://lists.gnu.org/archive/html/bug-gettext/2014-10/msg00028.html>.
* xgettext.c (arglist_parser_remember_literal): Don't assume that
ARGNUM1 and ARGNUM2 are different.

diff --git a/gettext-tools/src/ChangeLog b/gettext-tools/src/ChangeLog
index fd943c80ab6b863bab30b5b9a5c6abe6d0629b1d..e5ff794817546025d59a804e415cbf4b012059e2 100644 (file)
--- a/gettext-tools/src/ChangeLog
+++ b/gettext-tools/src/ChangeLog
@@ -1,3 +1,14 @@
+2014-10-28  Daiki Ueno  <ueno@gnu.org>
+
+       xgettext: Fix double-free in singular/plural argument extraction
+       After commit 6aa7b7ed in 2009, xgettext assumed that ARGNUM1 and
+       ARGNUM2 of -k are different.  That could cause an double-free in
+       exceptional cases.
+       Reported by Johan Liljegren in:
+       <https://lists.gnu.org/archive/html/bug-gettext/2014-10/msg00028.html>.
+       * xgettext.c (arglist_parser_remember_literal): Don't assume that
+       ARGNUM1 and ARGNUM2 are different.
+
 2014-10-15  Daiki Ueno  <ueno@gnu.org>
 
        * gettext 0.19.3 released.

diff --git a/gettext-tools/src/xgettext.c b/gettext-tools/src/xgettext.c
index eb3a6602556cdb28938a600df108ed1e0dbe1207..a8f3af69924111e9c29851d3143d129be918da63 100644 (file)
--- a/gettext-tools/src/xgettext.c
+++ b/gettext-tools/src/xgettext.c
@@ -2791,7 +2791,7 @@ arglist_parser_remember_literal (struct arglist_parser *ap,
               /* Mark msgid as done.  */
               cp->argnum1 = 0;
             }
-          if (argnum == cp->argnum2)
+          else if (argnum == cp->argnum2)
             {
               cp->msgid_plural = string;
               cp->msgid_plural_escape = type;