1. openvpn
  2. Commit 1f300fe94f1bd521966bb05dea40edc1fae82b84
Browse code

Fix double-free issue in pf_destroy_context()

In commit dc7be6d078ba106f9b0de12f3e879c3561c3c537 the string_alloc() call
in pf_init_context() was modified to use the gc_arena object for memory
allocation. What was not taken into consideration was that
pf_destroy_context() was also freeing memory allocated by string_alloc(),
and when pf_init_context() is calling gc_free() a double-free situation
showed up.

Lets remove the explict free, and let gc_free take care of all the memory
handling.

Reported-by: cuzz@163.com
Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1352196216-11560-1-git-send-email-dazo@users.sourceforge.net
URL: http://article.gmane.org/gmane.network.openvpn.devel/7124

David Sommerseth authored on 2012/11/06 18:59:01
Showing 1 changed files
src/openvpn/pf.c
History View file @ 1f300fe
... ... 
@@ -606,7 +606,6 @@ pf_destroy_context (struct pf_context *pfc)
606 606 
   if (pfc->filename)
607 607 
     {
608 608 
       platform_unlink (pfc->filename);
609 
-      free (pfc->filename);
610 609 
     }
611 610 
 #endif
612 611 
   if (pfc->pfs)