Repository navigation
lib: fix stale error_file pointer and error line on config re-read - #308
Merged
hyperrealm merged 1 commit intoNov 5, 2026
Merged
Conversation
__config_read() never cleared error_text, error_line or error_type, and
config_clear() freed config->filenames without clearing error_file,
which points into that vector.
On a config_t that is read more than once, a failed config_read_file()
followed by a successful one leaves config_error_file() pointing at a
freed string. A later I/O error doesn't touch error_file, so the usual
fprintf("%s:%d - %s", config_error_file(&cfg), ...) report reads freed
memory. The stale error_text also makes libconfig_yyerror() return
early, so the next parse error is reported with the previous read's
line and message.
Clear error_file in config_clear() together with the storage it points
into, start each read with a clean error state, and clear the file and
line on the config_read_file() I/O-error path. ErrorStateOnReread
covers both cases and fails without the fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
__config_read()never reset the error fields, so on a reusedconfig_ta staleerror_textmakeslibconfig_yyerror()skip the next parse error (it reports the previous read's line and message), and after a failed read followed by a successful oneconfig_error_file()still points into thefilenamesvector thatconfig_clear()just freed, which the usualfprintf("%s:%d - %s", config_error_file(&cfg), ...)report then reads on the next I/O error (ASan: heap-use-after-free, freed inconfig_clear()via__config_read());config_clear()now dropserror_filealong with the storage it points into, each read starts from a clean error state, and the newErrorStateOnRereadtest fails without the fix.