Skip to contentSkip to conversation

Fix double-free issue in pf_destroy_context()

PATCH Applied David Sommerseth 3 participants 3 messages Nov 6, 2012

lore
Share & tools
lore

David Sommerseth

author
#0 lore raw

PATCH 1/1 Fix double-free issue in pf_destroy_context()

From: David Sommerseth <[email protected]...>

In commit dc7be6d078ba106f9b0de12f3e879c3561c3c537 the string_alloc() call in pf_init_context() was modified to use the gc_arena object for memory allocation. What was not taken into consideration was that pf_destroy_context() was also freeing memory allocated by string_alloc(), and when pf_init_context() is calling gc_free() a double-free situation showed up.

Lets remove the explict free, and let gc_free take care of all the memory handling.

Reported-by [email protected]...
Signed-off-by David Sommerseth <[email protected]...>
---
 src/openvpn/pf.c |    1 -
 1 file changed, 1 deletion(-)
src/openvpn/pf.c +0 -1
index 3c46801..aafe9ff 100644
@@ -606,7 +606,6 @@ pf_destroy_context (struct pf_context *pfc)
   if (pfc->filename)
     {
       platform_unlink (pfc->filename);
-      free (pfc->filename);
     }
 #endif
   if (pfc->pfs)
Signature · 1 line
1.7.10.2
#1 lore raw

Hi,

Quoted 9 lines · David Sommerseth

From: David Sommerseth <[email protected]...>

In commit dc7be6d078ba106f9b0de12f3e879c3561c3c537 the string_alloc() call in pf_init_context() was modified to use the gc_arena object for memory allocation. What was not taken into consideration was that pf_destroy_context() was also freeing memory allocated by string_alloc(), and when pf_init_context() is calling gc_free() a double-free situation showed up.

Lets remove the explict free, and let gc_free take care of all the memory handling.

ACK (having read the through the relevant bits of init.c and through pf_init_context()).

gert

Signature · 4 lines
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...
Applied
#2 lore raw
In reply to David Sommerseth
Quoted 8 lines · David Sommerseth

From: David Sommerseth <[email protected]...>

In commit dc7be6d078ba106f9b0de12f3e879c3561c3c537 the string_alloc() call in pf_init_context() was modified to use the gc_arena object for memory allocation. What was not taken into consideration was that pf_destroy_context() was also freeing memory allocated by string_alloc(), and when pf_init_context() is calling gc_free() a double-free situation showed up.

Quoted 7 lines

Lets remove the explict free, and let gc_free take care of all the memory handling.

Reported-by [email protected]...
Signed-off-by David Sommerseth <[email protected]...>
---
 src/openvpn/pf.c |    1 -
 1 file changed, 1 deletion(-)

Applied to master and beta/2.3 branches.

commit 1f300fe94f1bd521966bb05dea40edc1fae82b84 (master) commit 03dfcd95b29eda81aee117bf9d28c001f2521e15 (beta/2.3)

Author: David Sommerseth <[email protected]...>
Date:   Tue Nov 6 10:59:01 2012 +0100
    Fix double-free issue in pf_destroy_context()

    Reported-by: [email protected]...
    Signed-off-by: David Sommerseth <[email protected]...>
    Acked-by: Gert Doering <[email protected]...>
    Message-Id: [email protected]...
    URL: http://article.gmane.org/gmane.network.openvpn.devel/7124

kind regards,

David Sommerseth