Fix use-after-free bug with cached settings values

This patch fixes a couple of use-after-free bugs when caching various
string related setting values.

Fixes: #143

2 files changed, 26 insertions, 16 deletions

diff --git a/src/core/expandos.c b/src/core/expandos.c
index bed6c5eb..1fc517af 100644
--- a/src/core/expandos.c
+++ b/src/core/expandos.c
@@ -57,7 +57,7 @@ static char *last_sent_msg, *last_sent_msg_body;
 static char *last_privmsg_from, *last_public_from;
 static char *sysname, *sysrelease, *sysarch;
 
-static const char *timestamp_format;
+static char *timestamp_format;
 static int timestamp_seconds;
 static time_t last_timestamp;
 
@@ -567,7 +567,9 @@ static int sig_timer(void)
 
 static void read_settings(void)
 {
-	timestamp_format = settings_get_str("timestamp_format");
+	g_free_not_null(timestamp_format);
+	timestamp_format = g_strdup(settings_get_str("timestamp_format"));
+
 	timestamp_seconds =
 		strstr(timestamp_format, "%r") != NULL ||
 		strstr(timestamp_format, "%s") != NULL ||
@@ -708,14 +710,18 @@ void expandos_deinit(void)
 		g_free_not_null(char_expandos[n]);
 
 	g_hash_table_foreach_remove(expandos, free_expando, NULL);
-        g_hash_table_destroy(expandos);
+	g_hash_table_destroy(expandos);
 
-	g_free_not_null(last_sent_msg); g_free_not_null(last_sent_msg_body);
-	g_free_not_null(last_privmsg_from); g_free_not_null(last_public_from);
-	g_free_not_null(sysname); g_free_not_null(sysrelease);
-        g_free_not_null(sysarch);
+	g_free_not_null(last_sent_msg);
+	g_free_not_null(last_sent_msg_body);
+	g_free_not_null(last_privmsg_from);
+	g_free_not_null(last_public_from);
+	g_free_not_null(sysname);
+	g_free_not_null(sysrelease);
+	g_free_not_null(sysarch);
+	g_free_not_null(timestamp_format);
 
-        g_source_remove(timer_tag);
+	g_source_remove(timer_tag);
 	signal_remove("message public", (SIGNAL_FUNC) sig_message_public);
 	signal_remove("message private", (SIGNAL_FUNC) sig_message_private);
 	signal_remove("message own_private", (SIGNAL_FUNC) sig_message_own_private);
diff --git a/src/core/log.c b/src/core/log.c
index 263b3526..d4d3853e 100644
--- a/src/core/log.c
+++ b/src/core/log.c
@@ -41,7 +41,7 @@ static const char *log_item_types[] = {
 	NULL
 };
 
-const char *log_timestamp;
+static char *log_timestamp;
 static int log_file_create_mode;
 static int log_dir_create_mode;
 static int rotate_tag;
@@ -558,13 +558,15 @@ static void log_read_config(void)
 
 static void read_settings(void)
 {
-	log_timestamp = settings_get_str("log_timestamp");
+	g_free_not_null(log_timestamp);
+	log_timestamp = g_strdup(settings_get_str("log_timestamp"));
+
 	log_file_create_mode = octal2dec(settings_get_int("log_create_mode"));
 
-        log_dir_create_mode = log_file_create_mode;
-        if (log_file_create_mode & 0400) log_dir_create_mode |= 0100;
-        if (log_file_create_mode & 0040) log_dir_create_mode |= 0010;
-        if (log_file_create_mode & 0004) log_dir_create_mode |= 0001;
+	log_dir_create_mode = log_file_create_mode;
+	if (log_file_create_mode & 0400) log_dir_create_mode |= 0100;
+	if (log_file_create_mode & 0040) log_dir_create_mode |= 0010;
+	if (log_file_create_mode & 0004) log_dir_create_mode |= 0001;
 }
 
 void log_init(void)
@@ -595,7 +597,9 @@ void log_deinit(void)
 	while (logs != NULL)
 		log_close(logs->data);
 
+	g_free_not_null(log_timestamp);
+
 	signal_remove("setup changed", (SIGNAL_FUNC) read_settings);
-        signal_remove("setup reread", (SIGNAL_FUNC) log_read_config);
-        signal_remove("irssi init finished", (SIGNAL_FUNC) log_read_config);
+	signal_remove("setup reread", (SIGNAL_FUNC) log_read_config);
+	signal_remove("irssi init finished", (SIGNAL_FUNC) log_read_config);
 }