Subject: wu-ftpd bug in hostacc.c:endhacc()

From: Jaakko Hyvatti <[email-masked]>
Date: Thu, 13 Apr 1995 17:12:53 +0200 (EET DST)

Linux C libraries have always been very sensitive to free()ing same
malloc()ed memory block twice.  This has exposed quite a few bugs
previously, and now as I installed wu-ftpd-2.4 with linux libc-5.0.0
this revealed a bug in hostacc.c: endhacc().

  This bug affects all Linux systems that have host access lists with
multiple hostnames per config line defined.  wu-ftpd crashes with SEGV
randomly.

  (Seems to me like structure of ha_arr had changed but the deallocator
routine was left as it is. Am I right?)

  Fix is trivial, patch below:

*** wu-ftpd-2.4/src/hostacc.c.~1~	Mon Aug  1 15:31:38 1994
--- wu-ftpd-2.4/src/hostacc.c	Thu Apr 13 17:10:05 1995
***************
*** 296,308 ****
          int     iInd;
          hacc_t  *ptHtmp;
  
!         for(iInd=0, ptHtmp = ha_arr;
!             (ptHtmp->ha_hosts[iInd]);
!             iInd++)
!         {
!                 free(ptHtmp->ha_login);
!                 free(ptHtmp->ha_hosts[iInd]);
!         }
  
          if (fclose(ptFp))
                  return (-1);
--- 296,317 ----
          int     iInd;
          hacc_t  *ptHtmp;
  
! 	for (ptHtmp = ha_arr;
! 	     ptHtmp < ha_arr + MAXLIN && ptHtmp->ha_type;
! 	     ptHtmp++)
! 	{
! 		ptHtmp->ha_type = 0;
! 		if (ptHtmp->ha_login) {
! 			free(ptHtmp->ha_login);
! 			ptHtmp->ha_login = NULL;
! 		}
! 		for(iInd=0;
! 		    iInd < MAXHST && ptHtmp->ha_hosts[iInd];
! 		    iInd++) {
! 			free(ptHtmp->ha_hosts[iInd]);
! 			ptHtmp->ha_hosts[iInd] = NULL;
! 		}
! 	}
  
          if (fclose(ptFp))
                  return (-1);

  Hope this help someone.