diff options
| author | Rainer Gerhards <rgerhards@adiscon.com> | 2009-09-24 10:49:11 +0200 |
|---|---|---|
| committer | Rainer Gerhards <rgerhards@adiscon.com> | 2009-09-24 10:49:11 +0200 |
| commit | e0dde79a806f46790df6104a6bacdbddaa938fd6 (patch) | |
| tree | 25a0401099cfd9bec8e2d342a40d14e2ec981bcb /runtime | |
| parent | 44844b8af3be216cec340c8ff83fdc6f1d6f1fff (diff) | |
| download | rsyslog-e0dde79a806f46790df6104a6bacdbddaa938fd6.tar.gz rsyslog-e0dde79a806f46790df6104a6bacdbddaa938fd6.tar.xz rsyslog-e0dde79a806f46790df6104a6bacdbddaa938fd6.zip | |
bugfix: potential segfault in stream writer on destruction
Most severely affected omfile. The problem was that some buffers were
freed before the asynchronous writer thread was shut down. So the
writer thread accessed invalid data, which may even already be
overwritten. Symptoms (with omfile) were segfaults, grabled data
and files with random names placed around the file system (most
prominently into the root directory). Special thanks to Aaron for
helping to track this down.
Diffstat (limited to 'runtime')
| -rw-r--r-- | runtime/stream.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/runtime/stream.c b/runtime/stream.c index 32467082..9e88eca1 100644 --- a/runtime/stream.c +++ b/runtime/stream.c @@ -685,11 +685,6 @@ dbgprintf("XXX: destruct stream %p\n", pThis); if(pThis->fd != -1) strmCloseFile(pThis); - free(pThis->pszDir); - free(pThis->pZipBuf); - free(pThis->pszCurrFName); - free(pThis->pszFName); - if(pThis->bAsyncWrite) { stopWriter(pThis); pthread_mutex_destroy(&pThis->mut); @@ -702,6 +697,15 @@ dbgprintf("XXX: destruct stream %p\n", pThis); } else { free(pThis->pIOBuf); } + + /* IMPORTANT: we MUST free this only AFTER the ansyncWriter has been stopped, else + * we get random errors... + */ + free(pThis->pszDir); + free(pThis->pZipBuf); + free(pThis->pszCurrFName); + free(pThis->pszFName); + ENDobjDestruct(strm) |