Fix potential double free in an error path.

diff --git a/plugins/sudoers/toke.c b/plugins/sudoers/toke.c
index dc60f8ff0698389ed830a3790bf1b50a1de5f82b..743d5ef942061a16ee7079f60a8fe53169e1f345 100644 (file)
--- a/plugins/sudoers/toke.c
+++ b/plugins/sudoers/toke.c
@@ -3436,6 +3436,7 @@ switch_dir(struct include_stack *stack, char *dirpath)
        pl->path = path;
        pl->next = first;
        first = pl;
+       path = NULL;
        count++;
     }
     closedir(dir);
@@ -3477,8 +3478,8 @@ bad:
     while (first != NULL) {
        pl = first;
        first = pl->next;
-       free(pl->path);
-       free(pl);
+       efree(pl->path);
+       efree(pl);
     }
     efree(sorted);
     efree(dirpath);

diff --git a/plugins/sudoers/toke.l b/plugins/sudoers/toke.l
index 6a9bae471230e72a015e0d1f68f12a580abe4f55..012d3780a80000968697b11852949540fa2b413e 100644 (file)
--- a/plugins/sudoers/toke.l
+++ b/plugins/sudoers/toke.l
@@ -714,6 +714,7 @@ switch_dir(struct include_stack *stack, char *dirpath)
        pl->path = path;
        pl->next = first;
        first = pl;
+       path = NULL;
        count++;
     }
     closedir(dir);
@@ -755,8 +756,8 @@ bad:
     while (first != NULL) {
        pl = first;
        first = pl->next;
-       free(pl->path);
-       free(pl);
+       efree(pl->path);
+       efree(pl);
     }
     efree(sorted);
     efree(dirpath);