branch master updated: install-info avoid accessing freed memory

[Gavin D. Smith]

This is an automated email from the git hooks/post-receive script.

gavin pushed a commit to branch master
in repository texinfo.

The following commit(s) were added to refs/heads/master by this push:
     new 39d38dd  install-info avoid accessing freed memory
39d38dd is described below

commit 39d38dd035c72aa7637910ffbf08532d1ac41848
Author: Gavin Smith <gavinsmith0123@gmail.com>
AuthorDate: Wed Nov 24 20:57:13 2021 +0000

    install-info avoid accessing freed memory
    
    * install-info/install-info.c
    (reformat_new_entries): Do not free a string.  This avoids
    referencing freed memory in case the input was found to be
    malformed in format_entry.
    (format_entry): If entry is not malformed, free output argument
    before assigning to it.
    
    Report and investigation from Brendan O'Dea.
---
 ChangeLog                   | 13 +++++++++++++
 install-info/install-info.c |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 0517172..d6245cf 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,16 @@
+2021-11-24  Gavin Smith  <gavinsmith0123@gmail.com>
+
+       install-info avoid accessing freed memory
+
+       * install-info/install-info.c
+       (reformat_new_entries): Do not free a string.  This avoids
+       referencing freed memory in case the input was found to be
+       malformed in format_entry.
+       (format_entry): If entry is not malformed, free output argument
+       before assigning to it.
+       
+       Report and investigation from Brendan O'Dea.
+
 2021-11-15 Ville Skyttä <ville.skytta@iki.fi>  (tiny change):
 
        No egrep or fgrep
diff --git a/install-info/install-info.c b/install-info/install-info.c
index e10f492..32868ac 100644
--- a/install-info/install-info.c
+++ b/install-info/install-info.c
@@ -1542,6 +1542,7 @@ format_entry (char *name, size_t name_len, char *desc, 
size_t desc_len,
   if (offset_out)
     strncat (outstr, line_out, offset_out);
 
+  free (*outstr_out);
   *outstr_out = outstr;
   *outstr_len = strlen (outstr);
   return 1;
@@ -1657,7 +1658,6 @@ reformat_new_entries (struct spec_entry *entries, int 
calign_cli, int align_cli,
       char *name = NULL, *desc = NULL;
       size_t name_len = 0, desc_len = 0;
       split_entry (entry->text, &name, &name_len, &desc, &desc_len);
-      free (entry->text);
 
       /* Specify sane defaults if we need to */
       if (calign_cli == -1 || align_cli == -1)