Viktor Tusa discovered an error in the affile destination driver: if opening the destination failed (for example, due to insufficient permissions), next was set to NULL, and later on, at the end of affile_dd_open_writer() tried to dereferrence it. A simple workaround is to return NULL in case next is NULL. Reported-by: Viktor Tusa <tusa@balabit.hu> Signed-off-by: Gergely Nagy <algernon@balabit.hu> --- modules/affile/affile.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/modules/affile/affile.c b/modules/affile/affile.c index 87767aa..57ccb7a 100644 --- a/modules/affile/affile.c +++ b/modules/affile/affile.c @@ -1052,6 +1052,9 @@ affile_dd_open_writer(gpointer args[]) } } } + if (!next) + return NULL; + next->queue_pending = TRUE; /* we're returning a reference */ return &next->super; -- 1.7.2.5