[syslog-ng] [PATCH] value-pairs: Fix a double free on parse errors

Balazs Scheidler bazsi at balabit.hu
Wed Mar 14 21:06:12 CET 2012


On Wed, 2012-03-14 at 10:31 +0100, Gergely Nagy wrote:
> In the command-line parser code, when we encountered an error, we
> explicitly free'd the value-pairs structure, but did not return. A few
> lines later, we called vp_cmdline_parse_rekey_finish(), which also tried
> to free the same structure.
> 
> Instead, we should only call _rekey_finish() if we didn't NULL out the
> value pairs structure earlier.
> 
> Signed-off-by: Gergely Nagy <algernon at balabit.hu>
> ---
>  lib/value-pairs.c |    3 ++-
>  1 files changed, 2 insertions(+), 1 deletions(-)
> 
> diff --git a/lib/value-pairs.c b/lib/value-pairs.c
> index 12cf831..912164f 100644
> --- a/lib/value-pairs.c
> +++ b/lib/value-pairs.c
> @@ -678,7 +678,8 @@ value_pairs_new_from_cmdline (GlobalConfig *cfg,
>        vp = NULL;
>      }
>    g_option_context_free (ctx);
> -  vp_cmdline_parse_rekey_finish (user_data_args);
> +  if (vp)
> +    vp_cmdline_parse_rekey_finish (user_data_args);

Ops, I haven't noticed this patch, however I think my solution (just
posted in the other thread) is somewhat better.

You may have some data allocated by the parser, which wouldn't be freed
in this case.

Please have a look at my patch and comment if that's ok.
Thanks.

-- 
Bazsi




More information about the syslog-ng mailing list