Esme Povirk (@madewokherd) commented about dlls/sane.ds/cfg.c:
sprintf(buffer, "%s=%s\n", (option->name), option->value.bool_val ? "true" : "false");
break;
- }
- size = GetFileSize(hFile, NULL);
- content = (CHAR*)malloc(size + sizeof(CHAR));
- ReadFile(hFile, content, size, &read, NULL);
- content[size / sizeof(CHAR)] = '\0';
- CloseHandle(hFile);
- new_content = NULL;
- found = FALSE;
- sprintf(search, "%s=", option->name);
- if (content)
This is checking whether the malloc succeeded after the allocated value has already been used.