diff options
| author | David Sommerseth <davids@redhat.com> | 2012-11-06 10:59:01 +0100 |
|---|---|---|
| committer | David Sommerseth <davids@redhat.com> | 2012-11-06 11:52:44 +0100 |
| commit | 1f300fe94f1bd521966bb05dea40edc1fae82b84 (patch) | |
| tree | b3eeca4d50a82d3c43710f0f71b84528b1f8384a /src/openvpn/pf.c | |
| parent | 0563473601abfbf2142bfa0ca5b863c5aa7953a2 (diff) | |
| download | openvpn-1f300fe94f1bd521966bb05dea40edc1fae82b84.tar.gz openvpn-1f300fe94f1bd521966bb05dea40edc1fae82b84.tar.xz openvpn-1f300fe94f1bd521966bb05dea40edc1fae82b84.zip | |
Fix double-free issue in pf_destroy_context()
In commit dc7be6d078ba106f9b0de12f3e879c3561c3c537 the string_alloc() call
in pf_init_context() was modified to use the gc_arena object for memory
allocation. What was not taken into consideration was that
pf_destroy_context() was also freeing memory allocated by string_alloc(),
and when pf_init_context() is calling gc_free() a double-free situation
showed up.
Lets remove the explict free, and let gc_free take care of all the memory
handling.
Reported-by: cuzz@163.com
Signed-off-by: David Sommerseth <davids@redhat.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: 1352196216-11560-1-git-send-email-dazo@users.sourceforge.net
URL: http://article.gmane.org/gmane.network.openvpn.devel/7124
Diffstat (limited to 'src/openvpn/pf.c')
| -rw-r--r-- | src/openvpn/pf.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/src/openvpn/pf.c b/src/openvpn/pf.c index 3c46801..aafe9ff 100644 --- a/src/openvpn/pf.c +++ b/src/openvpn/pf.c @@ -606,7 +606,6 @@ pf_destroy_context (struct pf_context *pfc) if (pfc->filename) { platform_unlink (pfc->filename); - free (pfc->filename); } #endif if (pfc->pfs) |