From: Amos Jeffries <squid3@treenet.co.nz>
Date: Sun, 15 Mar 2015 02:05:44 +0000 (-0700)
Subject: Bug 4215: double-free in CBDATA with --enable-debug-cbdata
X-Git-Tag: merge-candidate-3-v1~217
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=08650a87447262d3f59bee9fa14c130a28e3bb30;p=thirdparty%2Fsquid.git

Bug 4215: double-free in CBDATA with --enable-debug-cbdata
---

diff --git a/src/cbdata.cc b/src/cbdata.cc
index 971c2b910b..fc2515813e 100644
--- a/src/cbdata.cc
+++ b/src/cbdata.cc
@@ -273,6 +273,17 @@ cbdataRealFree(cbdata *c, const char *file, const int line)
     dlinkDelete(&c->link, &cbdataEntries);
 #endif
 
+#if HASHED_CBDATA
+    hash_remove_link(cbdata_htable, &c->hash);
+#if USE_CBDATA_DEBUG
+    debugs(45, 3, "Call delete " << p << " " << file << ":" << line);
+#endif
+    delete c;
+#else
+#if USE_CBDATA_DEBUG
+    debugs(45, 3, "Call cbdata::~cbdata() " << p << " " << file << ":" << line);
+#endif
+
     /* This is ugly. But: operator delete doesn't get
      * the type parameter, so we can't use that
      * to free the memory.
@@ -284,19 +295,9 @@ cbdataRealFree(cbdata *c, const char *file, const int line)
      * and it would Just Work. RBC 20030902
      */
     cbdata_type theType = c->type;
-#if HASHED_CBDATA
-    hash_remove_link(cbdata_htable, &c->hash);
-#if USE_CBDATA_DEBUG
-    debugs(45, 3, "Call delete " << p << " " << file << ":" << line);
-#endif
-    delete c;
-#else
-#if USE_CBDATA_DEBUG
-    debugs(45, 3, "Call cbdata::~cbdata() " << p << " " << file << ":" << line);
-#endif
     c->cbdata::~cbdata();
-#endif
     cbdata_index[theType].pool->freeOne(p);
+#endif
 }
 
 void *