Fix use after free errors in xlat.c

[freeradius.git] / src / main / xlat.c

diff --git a/src/main/xlat.c b/src/main/xlat.c
index 1df17be..8685e26 100644 (file)
--- a/src/main/xlat.c
+++ b/src/main/xlat.c
@@ -925,7 +925,6 @@ static ssize_t xlat_tokenize_expansion(TALLOC_CTX *ctx, char *fmt, xlat_exp_t **
         *      %{request:Tunnel-Password:1[#]}
         *      %{mod:foo}
         */
-       brace = NULL;
 
        /*
         *      This is for efficiency, so we don't search for an xlat,
@@ -937,10 +936,7 @@ static ssize_t xlat_tokenize_expansion(TALLOC_CTX *ctx, char *fmt, xlat_exp_t **
 
                if (isspace((int) *q)) break;
 
-               if (*q == '[') {
-                       is_attr = true;
-                       continue;
-               }
+               if (*q == '[') continue;
 
                if (*q == '}') break;
        }
@@ -950,7 +946,7 @@ static ssize_t xlat_tokenize_expansion(TALLOC_CTX *ctx, char *fmt, xlat_exp_t **
         */
        if ((*q == '}') && (q == p)) {
                *error = "Empty expression is invalid";
-               return -(q - fmt);
+               return -(p - fmt);
        }
 
        /*
@@ -1024,7 +1020,7 @@ static ssize_t xlat_tokenize_expansion(TALLOC_CTX *ctx, char *fmt, xlat_exp_t **
 
                talloc_free(node);
                *error = "Unknown attribute";
-               return -(node->fmt - fmt);
+               return -(p - fmt);
        }
 
        node->type = XLAT_ATTRIBUTE;