2022-01-31 11:56:03

by Dmitry V. Levin

Subject: [PATCH] rpcbind: fix double free in init_transport

$ rpcbind -h 127.0.0.1
free(): double free detected in tcache 2
Aborted

Fixes: a6889bba949b ("Removed resource leaks from src/rpcbind.c")
Resolves: https://sourceforge.net/p/rpcbind/bugs/6/
Signed-off-by: Dmitry V. Levin <[email protected]>
---
src/rpcbind.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/rpcbind.c b/src/rpcbind.c
index 25d8a90..ecebe97 100644
--- a/src/rpcbind.c
+++ b/src/rpcbind.c
@@ -552,8 +552,10 @@ init_transport(struct netconfig *nconf)
syslog(LOG_ERR, "cannot bind %s on %s: %m",
(hosts[nhostsbak] == NULL) ? "*" :
hosts[nhostsbak], nconf->nc_netid);
- if (res != NULL)
+ if (res != NULL) {
freeaddrinfo(res);
+ res = NULL;
+ }
continue;
} else
checkbind++;
--
ldv

2022-02-02 10:17:18

by Steve Dickson

Subject: Re: [PATCH] rpcbind: fix double free in init_transport

On 1/28/22 19:44, Dmitry V. Levin wrote:
> $ rpcbind -h 127.0.0.1
> free(): double free detected in tcache 2
> Aborted
>
> Fixes: a6889bba949b ("Removed resource leaks from src/rpcbind.c")
> Resolves: https://sourceforge.net/p/rpcbind/bugs/6/
> Signed-off-by: Dmitry V. Levin <[email protected]>
Committed... (tag: rpcbind-1_2_7-rc1)

steved.
> ---
> src/rpcbind.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/src/rpcbind.c b/src/rpcbind.c
> index 25d8a90..ecebe97 100644
> --- a/src/rpcbind.c
> +++ b/src/rpcbind.c
> @@ -552,8 +552,10 @@ init_transport(struct netconfig *nconf)
> syslog(LOG_ERR, "cannot bind %s on %s: %m",
> (hosts[nhostsbak] == NULL) ? "*" :
> hosts[nhostsbak], nconf->nc_netid);
> - if (res != NULL)
> + if (res != NULL) {
> freeaddrinfo(res);
> + res = NULL;
> + }
> continue;
> } else
> checkbind++;