From: Ben Pfaff <blp@gnu.org>
Date: Mon, 22 Jun 2009 04:11:25 +0000 (-0700)
Subject: crosstabs: Fix free of bad pointer and use-after-free error in cleanup.
X-Git-Tag: v0.7.3~27
X-Git-Url: https://pintos-os.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=67adf64d9367f8b43ef725d7f0c03895a5b6460b;p=pspp-builds.git

crosstabs: Fix free of bad pointer and use-after-free error in cleanup.

In free_proc, 'pt' points within an array that is dynamically
allocated, not to a data structure that is dynamically allocated, so
we must not try to free it on each iteration.  Instead, free the
dynamic array itself (proc->pivots) only once.
---

diff --git a/src/language/stats/crosstabs.q b/src/language/stats/crosstabs.q
index 76cae1b3..1d35e14e 100644
--- a/src/language/stats/crosstabs.q
+++ b/src/language/stats/crosstabs.q
@@ -234,8 +234,8 @@ free_proc (struct crosstabs_proc *proc)
 
          The rest of the data was allocated and destroyed at a
          lower level already. */
-      free (pt);
     }
+  free (proc->pivots);
 }
 
 static int internal_cmd_crosstabs (struct lexer *lexer, struct dataset *ds,