From 412c01b6f0ab2661d5161062eb1d988482ae0d7d Mon Sep 17 00:00:00 2001 From: Chong Yidong Date: Sun, 28 Feb 2010 09:19:31 -0500 Subject: Fix use of unitialized memory. * charset.c (load_charset_map_from_file) (load_charset_map_from_vector): Zero out allocated charset_map_entries before using them. --- src/ChangeLog | 6 ++++++ src/charset.c | 4 ++++ 2 files changed, 10 insertions(+) (limited to 'src') diff --git a/src/ChangeLog b/src/ChangeLog index 6cafe2f60a..f0a620b7b9 100644 --- a/src/ChangeLog +++ b/src/ChangeLog @@ -1,3 +1,9 @@ +2010-02-28 Chong Yidong + + * charset.c (load_charset_map_from_file) + (load_charset_map_from_vector): Zero out allocated + charset_map_entries before using them. + 2010-02-27 Andreas Schwab * w32uniscribe.c (uniscribe_check_otf): Fix length check. diff --git a/src/charset.c b/src/charset.c index 1db9ec17ae..125c913168 100644 --- a/src/charset.c +++ b/src/charset.c @@ -531,6 +531,7 @@ load_charset_map_from_file (charset, mapfile, control_flag) SAFE_ALLOCA (head, struct charset_map_entries *, sizeof (struct charset_map_entries)); entries = head; + bzero (entries, sizeof (struct charset_map_entries)); n_entries = 0; eof = 0; @@ -557,6 +558,7 @@ load_charset_map_from_file (charset, mapfile, control_flag) SAFE_ALLOCA (entries->next, struct charset_map_entries *, sizeof (struct charset_map_entries)); entries = entries->next; + bzero (entries, sizeof (struct charset_map_entries)); } idx = n_entries % 0x10000; entries->entry[idx].from = from; @@ -596,6 +598,7 @@ load_charset_map_from_vector (charset, vec, control_flag) SAFE_ALLOCA (head, struct charset_map_entries *, sizeof (struct charset_map_entries)); entries = head; + bzero (entries, sizeof (struct charset_map_entries)); n_entries = 0; for (i = 0; i < len; i += 2) @@ -632,6 +635,7 @@ load_charset_map_from_vector (charset, vec, control_flag) SAFE_ALLOCA (entries->next, struct charset_map_entries *, sizeof (struct charset_map_entries)); entries = entries->next; + bzero (entries, sizeof (struct charset_map_entries)); } idx = n_entries % 0x10000; entries->entry[idx].from = from; -- cgit v1.2.3