24814: suspicious handling of temporary history buffer

2 files changed, 9 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index 0ede31371..b4c1eace9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 2008-04-14  Peter Stephenson  <pws@csr.com>
 
+	* 24814: Src/hist.c: suspicious handling of temporary history
+	buffer.
+
 	* 24811: Doc/Zsh/roadmap.yo, Etc/FAQ.yo: update introductory
 	documentation on multibyte support.
 
diff --git a/Src/hist.c b/Src/hist.c
index a19c94818..58a8c61ff 100644
--- a/Src/hist.c
+++ b/Src/hist.c
@@ -2214,6 +2214,7 @@ savehistfile(char *fn, int err, int writeflags)
 #endif
 	     && sb.st_uid != euid) {
 		free(tmpfile);
+		tmpfile = NULL;
 		if (err) {
 		    if (isset(APPENDHISTORY) || isset(INCAPPENDHISTORY)
 		     || isset(SHAREHISTORY))
@@ -2292,6 +2293,7 @@ savehistfile(char *fn, int err, int writeflags)
 		if (rename(tmpfile, unmeta(fn)) < 0)
 		    zerr("can't rename %s.new to $HISTFILE", fn);
 		free(tmpfile);
+		tmpfile = NULL;
 	    }
 
 	    if (writeflags & HFILE_SKIPOLD
@@ -2317,12 +2319,13 @@ savehistfile(char *fn, int err, int writeflags)
 	ret = -1;
 
     if (ret < 0 && err) {
-	if (tmpfile) {
+	if (tmpfile)
 	    zerr("failed to write history file %s.new: %e", fn, errno);
-	    free(tmpfile);
-	} else
+	else
 	    zerr("failed to write history file %s: %e", fn, errno);
     }
+    if (tmpfile)
+	free(tmpfile);
 
     unlockhistfile(fn);
 }