From: Ted Lemon <source@isc.org>
Date: Mon, 12 Jun 2000 22:22:09 +0000 (+0000)
Subject: Clean up a possible memory smash in the binding code.
X-Git-Tag: V3-BETA-2-PATCH-1~149
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=55321a210e4b1b54364cf8cdc0bf54cfd92fe2c6;p=thirdparty%2Fdhcp.git

Clean up a possible memory smash in the binding code.
---

diff --git a/common/execute.c b/common/execute.c
index 0b599feb2..00d6fd7f7 100644
--- a/common/execute.c
+++ b/common/execute.c
@@ -43,7 +43,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: execute.c,v 1.32 2000/05/16 23:02:18 mellon Exp $ Copyright (c) 1998-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: execute.c,v 1.33 2000/06/12 22:22:09 mellon Exp $ Copyright (c) 1998-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -238,6 +238,7 @@ int execute_statements (packet, lease, in_options, out_options, scope,
 			if (!binding && status) {
 				binding = dmalloc (sizeof *binding, MDL);
 				if (binding) {
+				    memset (binding, 0, sizeof *binding);
 				    binding -> name =
 					    dmalloc (strlen
 						     (r -> data.set.name) + 1,
@@ -305,6 +306,7 @@ int execute_statements (packet, lease, in_options, out_options, scope,
 		      next_let:
 			if (ns) {
 				binding = dmalloc (sizeof *binding, MDL);
+				memset (binding, 0, sizeof *binding);
 				if (!binding) {
 				   blb:
 				    binding_scope_dereference (&ns, MDL);
diff --git a/common/tree.c b/common/tree.c
index 625147c8a..9f3896982 100644
--- a/common/tree.c
+++ b/common/tree.c
@@ -43,7 +43,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: tree.c,v 1.82 2000/05/17 16:04:04 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: tree.c,v 1.83 2000/06/12 22:22:08 mellon Exp $ Copyright (c) 1995-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -486,10 +486,11 @@ int evaluate_expression (result, packet, lease,
 				binding_scope_dereference (&ns, MDL);
 				return 0;
 			} else {
+				memset (nb, 0, sizeof *nb);
 				nb -> name = dmalloc (strlen (s -> string) + 1,
 						      MDL);
 				if (nb -> name)
-					strcpy (binding -> name, s -> string);
+					strcpy (nb -> name, s -> string);
 				else {
 					dfree (nb, MDL);
 					nb = (struct binding *)0;