2023-08-01 15:34:07

by Steve Dickson

Subject: [PATCH 2/2] rpcb_clnt.c: Eliminate double frees in delete_cache()

From: Herb Wartens <[email protected]>

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2224666
Signed-off-by: Steve Dickson <[email protected]>
---
src/rpcb_clnt.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/rpcb_clnt.c b/src/rpcb_clnt.c
index c0a9e12..68fe69a 100644
--- a/src/rpcb_clnt.c
+++ b/src/rpcb_clnt.c
@@ -262,12 +262,15 @@ delete_cache(addr)
for (cptr = front; cptr != NULL; cptr = cptr->ac_next) {
if (!memcmp(cptr->ac_taddr->buf, addr->buf, addr->len)) {
/* Unlink from cache. We'll destroy it after releasing the mutex. */
- if (cptr->ac_uaddr)
+ if (cptr->ac_uaddr) {
free(cptr->ac_uaddr);
- if (prevptr)
+ cptr->ac_uaddr = NULL;
+ }
+ if (prevptr) {
prevptr->ac_next = cptr->ac_next;
- else
+ } else {
front = cptr->ac_next;
+ }
cachesize--;
break;
}
--
2.41.0

2023-08-07 11:22:46

by Steve Dickson

Subject: Re: [Libtirpc-devel] [PATCH 2/2] rpcb_clnt.c: Eliminate double frees in delete_cache()

On 8/1/23 10:42 AM, Steve Dickson wrote:
> From: Herb Wartens <[email protected]>
>
> Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2224666
> Signed-off-by: Steve Dickson <[email protected]>
Committed... (tag: libtirpc-1-3-4-rc2)

steved
> ---
> src/rpcb_clnt.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/src/rpcb_clnt.c b/src/rpcb_clnt.c
> index c0a9e12..68fe69a 100644
> --- a/src/rpcb_clnt.c
> +++ b/src/rpcb_clnt.c
> @@ -262,12 +262,15 @@ delete_cache(addr)
> for (cptr = front; cptr != NULL; cptr = cptr->ac_next) {
> if (!memcmp(cptr->ac_taddr->buf, addr->buf, addr->len)) {
> /* Unlink from cache. We'll destroy it after releasing the mutex. */
> - if (cptr->ac_uaddr)
> + if (cptr->ac_uaddr) {
> free(cptr->ac_uaddr);
> - if (prevptr)
> + cptr->ac_uaddr = NULL;
> + }
> + if (prevptr) {
> prevptr->ac_next = cptr->ac_next;
> - else
> + } else {
> front = cptr->ac_next;
> + }
> cachesize--;
> break;
> }