From: Vsevolod Stakhov <vsevolod@rspamd.com>
Date: Tue, 21 Oct 2025 10:53:19 +0000 (+0100)
Subject: [Fix] Prevent double-free in mempool destructor cleanup
X-Git-Tag: 3.14.0~52^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=925304d7ac09b9b16d3d2a7c8a09fcc97349045e;p=thirdparty%2Frspamd.git

[Fix] Prevent double-free in mempool destructor cleanup

Mark heap as destroyed after rspamd_mempool_destructors_enforce to avoid
double destruction in subsequent rspamd_mempool_delete call
---

diff --git a/src/libutil/mem_pool.c b/src/libutil/mem_pool.c
index 726d66d7d9..d6362a06a1 100644
--- a/src/libutil/mem_pool.c
+++ b/src/libutil/mem_pool.c
@@ -849,6 +849,8 @@ void rspamd_mempool_destructors_enforce(rspamd_mempool_t *pool)
 
 		/* Destroy the heap itself */
 		rspamd_heap_destroy(rspamd_mempool_destruct_heap, &pool->priv->dtors_heap);
+		/* Mark heap as destroyed to prevent double-free in rspamd_mempool_delete */
+		pool->priv->dtors_heap.a = NULL;
 	}
 
 	rspamd_mempool_variables_cleanup(pool);