From: Eric Sandeen <sandeen@redhat.com>
Date: Thu, 1 Aug 2013 01:18:54 +0000 (+0000)
Subject: xfsprogs: avoid double-free in xfs_attr_node_addname
X-Git-Tag: v3.2.0-alpha1~70
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=504dbe46549d462e79565514d86ce69b74b96893;p=thirdparty%2Fxfsprogs-dev.git

xfsprogs: avoid double-free in xfs_attr_node_addname

xfs_attr_node_addname()'s error handling tests whether it
should free "state" in the out: error handling label:

out:
        if (state)
                xfs_da_state_free(state);

but an earlier free doesn't set state to NULL afterwards; this
could lead to a double free.  Fix it by setting state to NULL
after it's freed.

This was found by Coverity.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Mark Tinguely <tinguely@sgi.com>
---

diff --git a/libxfs/xfs_attr.c b/libxfs/xfs_attr.c
index cfc2f4b9e..6ef78094a 100644
--- a/libxfs/xfs_attr.c
+++ b/libxfs/xfs_attr.c
@@ -991,6 +991,7 @@ restart:
 			 * have been a b-tree.
 			 */
 			xfs_da_state_free(state);
+			state = NULL;
 			xfs_bmap_init(args->flist, args->firstblock);
 			error = xfs_attr3_leaf_to_node(args);
 			if (!error) {