Fix an xattr free of the wrong object.

In uncache_tmp_xattrs() the code used to find the value to unlink,
update the single-linked list, and then free the wrong pointer.
This fixes bug #50.

diff --git a/NEWS.md b/NEWS.md
index 440b8bdcd8c2870da3cb3d10ce9befc2386b411e..a3716df5fa7474efdbee2d0558c140848da2ba87 100644 (file)
--- a/NEWS.md
+++ b/NEWS.md
@@ -8,6 +8,9 @@
 
  - Fixed the specifying of --bwlimit=0 for the default (unlimited).
 
+ - Fixed a bug in the xattr code that was freeing the wrong object when trying
+   to cleanup the xattr list.
+
 ### ENHANCEMENTS:
 
  - Allow `--max-alloc=0` to specify no limit.

diff --git a/xattrs.c b/xattrs.c
index b3f0c1a34a5e6fada33c87d7303b974dd6703208..a7d7d5ab66df84c96806edb75822cdc26d23395c 100644 (file)
--- a/xattrs.c
+++ b/xattrs.c
@@ -922,17 +922,16 @@ void uncache_tmp_xattrs(void)
                                continue;
                        }
 
-                       while (ref != NULL) {
-                               if (ref->next == NULL) {
-                                       ref = NULL;
+                       while (1) {
+                               rsync_xa_list_ref *next = ref->next;
+                               if (next == NULL)
                                        break;
-                               }
-                               if (xa_list_item->ndx == ref->next->ndx) {
-                                       ref->next = ref->next->next;
-                                       free(ref);
+                               if (xa_list_item->ndx == next->ndx) {
+                                       ref->next = next->next;
+                                       free(next);
                                        break;
                                }
-                               ref = ref->next;
+                               ref = next;
                        }
                }
                prior_xattr_count = (size_t)-1;