Bugfix: Avoid double free of iri->orig_url

When accessing a URL using IDN which directly redirects to another page,
wget would xfree_null(iri->orig_url); in src/retr.c:retrieve_url()
first, then later xfree_null(iri->orig_url); in src/iri.c:iri_free()
again.

This can be tested with wget -O /dev/null http://μφ.net

diff --git a/src/ChangeLog b/src/ChangeLog
index f374605abf6cb4192034b69b048293e8ae6525d9..18a26694ecf25291b65d9f3778d22bce02f3af3f 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,8 @@
+2012-12-08  Michael Stapelberg <michael@stapelberg.de> (tiny change)
+
+       * retr.c (retrieve_url): Set iri->orig_url to NULL after it is
+       freed.
+
 2012-11-26  Giuseppe Scrivano  <gscrivano@gnu.org>
 
        * wget.h (MAX_INT_TO_STRING_LEN): Define macro.

diff --git a/src/retr.c b/src/retr.c
index 32dc41e27c695561566106c28d6edf8dd47065bf..0d564ef69ac7bb2c7d5b18ebfe5196639407a7b0 100644 (file)
--- a/src/retr.c
+++ b/src/retr.c
@@ -838,6 +838,7 @@ retrieve_url (struct url * orig_parsed, const char *origurl, char **file,
       iri->utf8_encode = opt.enable_iri;
       set_content_encoding (iri, NULL);
       xfree_null (iri->orig_url);
+      iri->orig_url = NULL;
 
       /* Now, see if this new location makes sense. */
       newloc_parsed = url_parse (mynewloc, &up_error_code, iri, true);