lynx-dev double free in HTSaveToFile/HTSaveAndExecute

[Dick Wesseling]

There's a flaw in LYCachedTemp() that breaks HTSaveToFile and 
HTSaveAndExecute.
The FREE macro can only be used when you have the *address* of a 
pointer. So, upon return from LYCachedTemp the space occupied by the 
cached filename is released, but me->anchor->FileCache is not set to 
zero and will be freed again at the end of HTSaveWhatever.
Protocol: view a link that requires an external viewer twice.
Fix: see below



*** HTFWriter.c.orig    Mon Jul 27 01:17:56 1998
--- HTFWriter.c Mon Jul 27 01:15:46 1998
***************
*** 548,558 ****
      me->input_format = pres->rep;
      me->output_format = pres->rep_out;
      me->anchor = anchor;
      me->sink = sink;
  
!     if (LYCachedTemp(fnam, anchor->FileCache)) {
          me->fp = LYNewBinFile (fnam);
      } else {
        /*
         *  Check for a suffix.
         *      Save the file under a suitably suffixed name.
--- 548,558 ----
      me->input_format = pres->rep;
      me->output_format = pres->rep_out;
      me->anchor = anchor;
      me->sink = sink;
  
!     if (LYCachedTemp(fnam, &anchor->FileCache)) {
          me->fp = LYNewBinFile (fnam);
      } else {
        /*
         *  Check for a suffix.
         *      Save the file under a suitably suffixed name.
***************
*** 701,711 ****
      }
  
      /*
       *        Set up a 'D'ownload.
       */
!     if (LYCachedTemp(fnam, anchor->FileCache)) {
        ret_obj->fp = LYNewBinFile (fnam);
      } else {
        /*
         *  Check for a suffix.
         *  Save the file under a suitably suffixed name.
--- 701,711 ----
      }
  
      /*
       *        Set up a 'D'ownload.
       */
!     if (LYCachedTemp(fnam, &anchor->FileCache)) {
        ret_obj->fp = LYNewBinFile (fnam);
      } else {
        /*
         *  Check for a suffix.
         *  Save the file under a suitably suffixed name.
*** LYUtils.c.orig      Mon Jul 27 01:14:51 1998
--- LYUtils.c   Mon Jul 27 01:15:49 1998
***************
*** 5466,5482 ****
  /*
   * Check if the given anchor has an associated file-cache.
   */
  PUBLIC BOOLEAN LYCachedTemp ARGS2(
        char *,         result,
!       char *,         cached)
  {
      FILE *fp;
  
!     if (cached) {
!       strcpy(result, cached);
!       FREE(cached);
        if ((fp = fopen(result, "r")) != NULL) {
            fclose(fp);
            remove(result);
        }
        return TRUE;
--- 5466,5482 ----
  /*
   * Check if the given anchor has an associated file-cache.
   */
  PUBLIC BOOLEAN LYCachedTemp ARGS2(
        char *,         result,
!       char **,        cached)
  {
      FILE *fp;
  
!     if (*cached) {
!       strcpy(result, *cached);
!       FREE(*cached);
        if ((fp = fopen(result, "r")) != NULL) {
            fclose(fp);
            remove(result);
        }
        return TRUE;
*** LYUtils.h.orig      Sat Jun 27 18:19:11 1998
--- LYUtils.h   Mon Jul 27 01:03:12 1998
***************
*** 58,68 ****
  extern FILE *LYNewTxtFile PARAMS((char * name));
  extern FILE *LYAppendToTxtFile PARAMS((char * name));
  #ifdef UNIX
  extern void LYRelaxFilePermissions PARAMS((CONST char * name));
  #endif
! extern BOOLEAN LYCachedTemp PARAMS((char *result, char *cached));
  extern FILE *LYOpenTemp PARAMS((char *result, CONST char *suffix, CONST char 
*mode));
  extern FILE *LYReopenTemp PARAMS((char *name));
  extern FILE *LYOpenScratch PARAMS((char *result, CONST char *prefix));
  extern void LYCloseTemp PARAMS((char *name));
  extern void LYCloseTempFP PARAMS((FILE *fp));
--- 58,68 ----
  extern FILE *LYNewTxtFile PARAMS((char * name));
  extern FILE *LYAppendToTxtFile PARAMS((char * name));
  #ifdef UNIX
  extern void LYRelaxFilePermissions PARAMS((CONST char * name));
  #endif
! extern BOOLEAN LYCachedTemp PARAMS((char *result, char **cached));
  extern FILE *LYOpenTemp PARAMS((char *result, CONST char *suffix, CONST char 
*mode));
  extern FILE *LYReopenTemp PARAMS((char *name));
  extern FILE *LYOpenScratch PARAMS((char *result, CONST char *prefix));
  extern void LYCloseTemp PARAMS((char *name));
  extern void LYCloseTempFP PARAMS((FILE *fp));