From 475b315a7a3bf140dccabd0a2ce6b77d3d3b0125 Mon Sep 17 00:00:00 2001
From: Mamoru TASAKA <mtasaka@fedoraproject.org>
Date: Fri, 4 Dec 2020 13:56:53 +0900
Subject: [PATCH] skf_convert.i: avoid double free for rubyext

With skf-2.10.14 and ruby 2.7.2p137, the following simple code:
`ruby -I. -e 'require "skf" ; Skf.convert("-s", [164, 162].pack("C*"))'`
causes double free, which does not occur on skf-2.10.12.

With skf-2.10.14, in *convert(@SKFCSTRINGS@ *optstr, @SKFSTRINGS@ *cstr),
the local value lwlstr is changed to be cleaned up by free() when returning
from the function.
On the other hand, with rubyext the input argument cstr is to be free'ed()
in the same function (as same as in 2.10.12). But as with rubyext lwlstr points
to cstr, this causes double free. Note that with perl or python extension,
lwlstr is newly generated (allocated) using the original cstr.

To avoid double free and to make rubyext behavior consistent with other
extensions, lwlstr in convert() (and quickconvert, guess) must be newly allocated.
---
 skf_convert.i | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/skf_convert.i b/skf_convert.i
index 113e845..1ff2522 100644
--- skf-2.10.14-a/skf_convert.i
+++ skf-2.10.14-b/skf_convert.i
@@ -1224,7 +1224,8 @@ static void r_skf_convert(struct Skf_localestring *lstr, long ibuflen,
     skf_script_init(); swig_state = 1;
 
 #if	defined(SWIGRUBY) && (defined(SKF_RUBY19) || defined(SKF_RUBY2))
-    lwlstr = cstr;
+    lwlstr = malloc(sizeof *lwlstr);
+    memcpy(lwlstr, cstr, sizeof *lwlstr);
     ibuflen = get_rstr_len(cstr);
 #elif	defined(SWIGPYTHON) 
     lwlstr = skf_pystring2skfstring(cstr,1);
@@ -1349,7 +1350,8 @@ static void r_skf_convert(struct Skf_localestring *lstr, long ibuflen,
     debug_opt = 0;
 
 #if	defined(SWIGRUBY) && (defined(SKF_RUBY19) || defined(SKF_RUBY2))
-    lwlstr = cstr;
+    lwlstr = malloc(sizeof *lwlstr);
+    memcpy(lwlstr, cstr, sizeof *lwlstr);
     ibuflen = get_rstr_len(cstr);
 #elif	defined(SWIGPYTHON) && defined(SKF_PYTHON3)
     lwlstr = skf_pystring2skfstring(cstr,1);
@@ -1452,7 +1454,8 @@ static void r_skf_convert(struct Skf_localestring *lstr, long ibuflen,
     in_saved_codeset = -1;
 
 #if	defined(SKF_RUBY19) || defined(SKF_RUBY2)
-    lwlstr = cstr;
+    lwlstr = malloc(sizeof *lwlstr);
+    memcpy(lwlstr, cstr, sizeof *lwlstr);
     ibuflen = get_rstr_len(cstr);
 #elif	defined(SWIGPYTHON) && defined(SKF_PYTHON3)
     lwlstr = skf_pystring2skfstring(cstr,1);
-- 
2.28.0