xfsprogs: avoid double-free in xfs_attr_node_addname

xfs_attr_node_addname()'s error handling tests whether it
should free "state" in the out: error handling label:

out:
        if (state)
                xfs_da_state_free(state);

but an earlier free doesn't set state to NULL afterwards; this
could lead to a double free.  Fix it by setting state to NULL
after it's freed.

This was found by Coverity.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Mark Tinguely <tinguely@sgi.com>

diff --git a/libxfs/xfs_attr.c b/libxfs/xfs_attr.c
index cfc2f4b9e3f64a24d2a2cc4cfc6df349d3622111..6ef78094adabcb665d5a118ae0f0d2295afb58e6 100644 (file)
--- a/libxfs/xfs_attr.c
+++ b/libxfs/xfs_attr.c
@@ -991,6 +991,7 @@ restart:
                         * have been a b-tree.
                         */
                        xfs_da_state_free(state);
+                       state = NULL;
                        xfs_bmap_init(args->flist, args->firstblock);
                        error = xfs_attr3_leaf_to_node(args);
                        if (!error) {