[En-Nut-Discussion] heap.c: Double free never detected

Moritz Struebe morty at gmx.net
Mon Apr 21 11:44:52 CEST 2008


Hi there,

I'm still morking on the heap.c. I think I found a bug:

The double free

(u_short)node + node->hn_size) > (u_short)fnode #

is never detected because

(u_short)node > (u_short)fnode

breaks the loop before reaching the double free check.

Or did I get something wrong once again?

Cheers
Morty



More information about the En-Nut-Discussion mailing list