Fix use after free when sending error messages. From Timo Juhani Lindfors

--HG--
branch : 1.7

diff --git a/logging.c b/logging.c
index c9756dd8e55806e687f1fe9c065699f12d615819..9034e7f0ddac244e16a0cb9c84d4c765ed04e766 100644 (file)
--- a/logging.c
+++ b/logging.c
@@ -390,7 +390,8 @@ log_error(flags, fmt, va_alist)
        else
            warningx("%s", message);
     }
-    efree(message);
+    if (logline != message)
+        efree(message);
 
     /*
      * Send a copy of the error via mail.
@@ -406,8 +407,7 @@ log_error(flags, fmt, va_alist)
     if (def_logfile)
        do_logfile(logline);
 
-    if (logline != message)
-       efree(logline);
+    efree(logline);
 
     if (!ISSET(flags, NO_EXIT)) {
        cleanup(0);