diff options
| author | ailin-nemui <ailin-nemui@users.noreply.github.com> | 2016-08-12 18:24:58 +0200 |
|---|---|---|
| committer | ailin-nemui <ailin-nemui@users.noreply.github.com> | 2016-08-12 18:24:58 +0200 |
| commit | b411f943a081b7c7fde0548f8c7ee5e93c0638a9 (patch) | |
| tree | 501643086bdc4eb7b345be5cf210430e8cf622d5 | |
| parent | 61fa6eb35b065299e76456a3b20e6f17d15b5016 (diff) | |
| download | irssi-b411f943a081b7c7fde0548f8c7ee5e93c0638a9.zip | |
fix use after free in expando error
| -rw-r--r-- | src/perl/common/Expando.xs | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/src/perl/common/Expando.xs b/src/perl/common/Expando.xs index e8e8f751..bb5d185b 100644 --- a/src/perl/common/Expando.xs +++ b/src/perl/common/Expando.xs @@ -74,15 +74,18 @@ static char *perl_expando_event(PerlExpando *rec, SERVER_REC *server, ret = NULL; if (SvTRUE(ERRSV)) { + PERL_SCRIPT_REC *script = rec->script; + (void) POPs; /* call putback before emitting script error signal as that * could manipulate the perl stack. */ PUTBACK; /* make sure we don't get back here */ - if (rec->script != NULL) - script_unregister_expandos(rec->script); + if (script != NULL) + script_unregister_expandos(script); + /* rec has been freed now */ - signal_emit("script error", 2, rec->script, SvPV_nolen(ERRSV)); + signal_emit("script error", 2, script, SvPV_nolen(ERRSV)); } else if (retcount > 0) { ret = g_strdup(POPp); *free_ret = TRUE; |