path: root/ui/ncurses/nc-menu.c
diff options
authorJeremy Kerr <>2014-03-12 14:22:47 +0800
committerJeremy Kerr <>2014-04-08 16:00:38 +0800
commit28926a0e2f144b09ac9e0a4d019c7f649fd9d5c1 (patch)
tree7d0371606513ec81b972870e86946da93de32db2 /ui/ncurses/nc-menu.c
parentbc72527a1426c2159112707d3a6c9bb544fd6647 (diff)
ui/ncurses: Don't free item in pmenu_item_setup
Currently pmenu_item_setup may free its item parameter on error. This makes it non-obvious whether the item is still allocated on exit to the caller. Instead, this change removes the talloc_free, and requires that the caller do this on error. This makes the potential use-after-free in cui_boot_editor_on_exit obvious, so we fix that too. Signed-off-by: Jeremy Kerr <>
Diffstat (limited to 'ui/ncurses/nc-menu.c')
1 files changed, 1 insertions, 3 deletions
diff --git a/ui/ncurses/nc-menu.c b/ui/ncurses/nc-menu.c
index cd7c54e..654c389 100644
--- a/ui/ncurses/nc-menu.c
+++ b/ui/ncurses/nc-menu.c
@@ -106,10 +106,8 @@ struct pmenu_item *pmenu_item_setup(struct pmenu *menu, struct pmenu_item *i,
i->pmenu = menu;
i->nci = new_item(name, NULL);
- if (!i->nci) {
- talloc_free(i);
+ if (!i->nci)
return NULL;
- }
set_item_userptr(i->nci, i);
OpenPOWER on IntegriCloud