Skip to content

Commit

Permalink
[irods#7540] Fix double-free in rsCollRepl
Browse files Browse the repository at this point in the history
rsCloseCollection already frees the struct that collEnt's members are assigned to. They are pointer-assigned in getNextCollMetaInfo/getNextDataObjMetaInfo, so they point to the same allocated memory. The reason this works normally is because the end of the while loop NULLs out collEnt, so freeCollEnt does nothing. When erroring, it doesn't happen, so freeCollEnt goes into clearCollEnt, which double-frees. Regular free is still needed in error cases, because collEnt itself won't be freed. Regular free will not fail in normal cases, because free(NULL) does nothing.
  • Loading branch information
FifthPotato authored and alanking committed Apr 3, 2024
1 parent 07c2510 commit aa687bd
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion server/api/src/rsCollRepl.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@ rsCollRepl( rsComm_t *rsComm, collInp_t *collReplInp,
collEnt = NULL;
}
rsCloseCollection( rsComm, &handleInx );
freeCollEnt( collEnt );
free(collEnt);

return savedStatus;
}

0 comments on commit aa687bd

Please sign in to comment.