Pidgin attempts to free an address which was not malloc()-ed

Ethan Blanton elb at pidgin.im
Wed Sep 20 13:13:52 EDT 2017


dequis wrote:
> Can repro under valgrind and 2.12.0
> 
> Manually minimized testcase:
> 
> :a 001 a :a
> :a 375 a :a
> :a 422 a :a
> 
> Looks like 422 is doing g_string_free(irc->motd, TRUE); without
> setting it to NULL, so trying to disconnect results in a double free
> (as in double freedom)

Looks easy enough to fix.

Ethan


More information about the security mailing list