picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

nspawn-oci: fix double free 

Also rename function to make it clear that it also frees the array
object itself.
This commit is contained in:
Zbigniew Jędrzejewski-Szmek 2019-03-22 17:23:49 +01:00
parent 54ed9f88dc
commit b2645747b7
4 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/nspawn/nspawn-settings.c
View File

@ -110,7 +110,7 @@ static void free_oci_hooks(OciHook *h, size_t n) {
free(h);
}
void device_node_free_many(DeviceNode *node, size_t n) {
void device_node_array_free(DeviceNode *node, size_t n) {
size_t i;
for (i = 0; i < n; i++)
@ -156,8 +156,7 @@ Settings* settings_free(Settings *s) {
sd_bus_message_unref(s->properties);
free(s->supplementary_gids);
device_node_free_many(s->extra_nodes, s->n_extra_nodes);
free(s->extra_nodes);
device_node_array_free(s->extra_nodes, s->n_extra_nodes);
free(s->network_namespace_path);
strv_free(s->sysctl);

2
src/nspawn/nspawn-settings.h
View File

@ -254,4 +254,4 @@ TimezoneMode timezone_mode_from_string(const char *s) _pure_;
int parse_link_journal(const char *s, LinkJournal *ret_mode, bool *ret_try);
void device_node_free_many(DeviceNode *node, size_t n);
void device_node_array_free(DeviceNode *node, size_t n);

4
src/nspawn/nspawn.c
View File

@ -3958,7 +3958,7 @@ static int merge_settings(Settings *settings, const char *path) {
arg_console_width = settings->console_width;
arg_console_height = settings->console_height;
device_node_free_many(arg_extra_nodes, arg_n_extra_nodes);
device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
arg_extra_nodes = TAKE_PTR(settings->extra_nodes);
arg_n_extra_nodes = settings->n_extra_nodes;
@ -5070,7 +5070,7 @@ finish:
custom_mount_free_all(arg_custom_mounts, arg_n_custom_mounts);
expose_port_free_all(arg_expose_ports);
rlimit_free_all(arg_rlimit);
device_node_free_many(arg_extra_nodes, arg_n_extra_nodes);
device_node_array_free(arg_extra_nodes, arg_n_extra_nodes);
if (r < 0)
return r;

5
test/fuzz/fuzz-nspawn-oci/crash-bffbd2085d4e95c47e9749b3f4a2dbc0580c20d3 Normal file
View File

@ -0,0 +1,5 @@
{"ociVersion": "1.0.0",
"linux": {"devices": [ { "access": "mmmw;r"}
] }, "e": "}e"
}