|
 |
6f51e1 |
From 8c39c9dbe69949065940019e930c37b8f5450a75 Mon Sep 17 00:00:00 2001
|
|
|
6f51e1 |
From: Adam Tkac <vonsch@gmail.com>
|
|
|
6f51e1 |
Date: Sat, 18 Mar 2017 23:34:54 +0100
|
|
|
6f51e1 |
Subject: [PATCH] Fix double-free in _cl5NewDBFile() error path
|
|
|
6f51e1 |
|
|
|
6f51e1 |
Although slapi_ch_free should prevent double-free errors, it doesn't work
|
|
|
6f51e1 |
in old code because after assignment
|
|
|
6f51e1 |
|
|
|
6f51e1 |
(*dbFile)->name = name;
|
|
|
6f51e1 |
|
|
|
6f51e1 |
two independent pointers points to the same allocated area and both pointers
|
|
|
6f51e1 |
are free()-ed (one directly in error path in _cl5NewDBFile and the second
|
|
|
6f51e1 |
in _cl5DBCloseFile, called in error path as well).
|
|
|
6f51e1 |
|
|
|
6f51e1 |
Signed-off-by: Mark Reynolds <mreynolds@redhat.com>
|
|
|
6f51e1 |
---
|
|
|
6f51e1 |
ldap/servers/plugins/replication/cl5_api.c | 7 ++++---
|
|
|
6f51e1 |
1 file changed, 4 insertions(+), 3 deletions(-)
|
|
|
6f51e1 |
|
|
|
6f51e1 |
diff --git a/ldap/servers/plugins/replication/cl5_api.c b/ldap/servers/plugins/replication/cl5_api.c
|
|
|
6f51e1 |
index fc70ab7..5c2233f 100644
|
|
|
6f51e1 |
--- a/ldap/servers/plugins/replication/cl5_api.c
|
|
|
6f51e1 |
+++ b/ldap/servers/plugins/replication/cl5_api.c
|
|
|
6f51e1 |
@@ -6269,9 +6269,10 @@ out:
|
|
|
6f51e1 |
}
|
|
|
6f51e1 |
|
|
|
6f51e1 |
(*dbFile)->db = db;
|
|
|
6f51e1 |
- (*dbFile)->name = name;
|
|
|
6f51e1 |
- (*dbFile)->replName = slapi_ch_strdup (replName);
|
|
|
6f51e1 |
- (*dbFile)->replGen = slapi_ch_strdup (replGen);
|
|
|
6f51e1 |
+ (*dbFile)->name = name;
|
|
|
6f51e1 |
+ name = NULL; /* transfer ownership to dbFile struct */
|
|
|
6f51e1 |
+ (*dbFile)->replName = slapi_ch_strdup (replName);
|
|
|
6f51e1 |
+ (*dbFile)->replGen = slapi_ch_strdup (replGen);
|
|
|
6f51e1 |
|
|
|
6f51e1 |
/*
|
|
|
6f51e1 |
* Considerations for setting up cl semaphore:
|
|
|
6f51e1 |
--
|
|
|
6f51e1 |
2.9.3
|
|
|
6f51e1 |
|