From c52ed2cbdc5b851ebc7bc19d7c682b14a4a16ba4 Mon Sep 17 00:00:00 2001 From: David Sommerseth Date: Mon, 9 Aug 2010 14:43:54 +0200 Subject: Python reference counter was not properly set for etherinfo_ipv6addr objects This caused a double free situation, when Python tried to free the object if the etherinfo::get_ipv6_addresses() method was called several times. In addition the ethtool::get_interfaces_info() would also free the structures uses by etherinfo_ipv6addr objects. Signed-off-by: David Sommerseth --- python-ethtool/etherinfo.c | 8 +++----- python-ethtool/etherinfo_obj.c | 1 + 2 files changed, 4 insertions(+), 5 deletions(-) (limited to 'python-ethtool') diff --git a/python-ethtool/etherinfo.c b/python-ethtool/etherinfo.c index 2091a3c..41a55fe 100644 --- a/python-ethtool/etherinfo.c +++ b/python-ethtool/etherinfo.c @@ -66,7 +66,9 @@ void free_ipv6addresses(struct ipv6address *ptr) { while( ipv6ptr ) { struct ipv6address *tmp = ipv6ptr->next; - free(ipv6ptr->address); + if( ipv6ptr->address ) { + free(ipv6ptr->address); + } free(ipv6ptr); ipv6ptr = tmp; } @@ -313,10 +315,6 @@ int get_etherinfo(struct etherinfo *ethinf, struct nl_handle *nlc, nlQuery query break; case NLQRY_ADDR: - /* Remove old IPv6 information we might have */ - free_ipv6addresses(ethinf->ipv6_addresses); - ethinf->ipv6_addresses = NULL; - /* Extract IP address information */ addr_cache = rtnl_addr_alloc_cache(nlc); addr = rtnl_addr_alloc(); diff --git a/python-ethtool/etherinfo_obj.c b/python-ethtool/etherinfo_obj.c index b651a1c..04eb634 100644 --- a/python-ethtool/etherinfo_obj.c +++ b/python-ethtool/etherinfo_obj.c @@ -234,6 +234,7 @@ PyObject * _ethtool_etherinfo_get_ipv6_addresses(etherinfo_py *self, PyObject *n if( ipv6_pyobj ) { PyTuple_SetItem(ret, i++, ipv6_pyobj); _PyTuple_Resize(&ret, i+1); + Py_INCREF(ipv6_pyobj); } ipv6 = next; } -- cgit