From: hno <>
Date: Wed, 8 Mar 2006 17:35:58 +0000 (+0000)
Subject: Fix a use after free error when writing the clean swap.state fails
X-Git-Tag: SQUID_3_0_PRE4~298
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=78fe982ffbbf7d320b37b68d1b7b3383be0cf923;p=thirdparty%2Fsquid.git

Fix a use after free error when writing the clean swap.state fails
---

diff --git a/src/fs/ufs/store_dir_ufs.cc b/src/fs/ufs/store_dir_ufs.cc
index a59c1a07d1..1ee6628422 100644
--- a/src/fs/ufs/store_dir_ufs.cc
+++ b/src/fs/ufs/store_dir_ufs.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: store_dir_ufs.cc,v 1.69 2005/02/05 22:02:32 serassio Exp $
+ * $Id: store_dir_ufs.cc,v 1.70 2006/03/08 10:35:58 hno Exp $
  *
  * DEBUG: section 47    Store Directory Routines
  * AUTHOR: Duane Wessels
@@ -936,25 +936,25 @@ UFSCleanLog::write(StoreEntry const &e)
     s.refcount = e.refcount;
     s.flags = e.flags;
     xmemcpy(&s.key, e.key, MD5_DIGEST_CHARS);
-    UFSCleanLog *state = this;
-    xmemcpy(state->outbuf + state->outbuf_offset, &s, ss);
-    state->outbuf_offset += ss;
+    xmemcpy(outbuf + outbuf_offset, &s, ss);
+    outbuf_offset += ss;
     /* buffered write */
 
-    if (state->outbuf_offset + ss > CLEAN_BUF_SZ) {
-        if (FD_WRITE_METHOD(state->fd, state->outbuf, state->outbuf_offset) < 0) {
+    if (outbuf_offset + ss > CLEAN_BUF_SZ) {
+        if (FD_WRITE_METHOD(fd, outbuf, outbuf_offset) < 0) {
+            /* XXX This error handling should probably move up to the caller */
             debug(50, 0) ("storeDirWriteCleanLogs: %s: write: %s\n",
-                          state->newLog, xstrerror());
+                          newLog, xstrerror());
             debug(50, 0) ("storeDirWriteCleanLogs: Current swap logfile not replaced.\n");
-            file_close(state->fd);
-            state->fd = -1;
-            unlink(state->newLog);
-            delete state;
+            file_close(fd);
+            fd = -1;
+            unlink(newLog);
             sd->cleanLog = NULL;
+            delete this;
             return;
         }
 
-        state->outbuf_offset = 0;
+        outbuf_offset = 0;
     }
 }