From: Oliver Kurth <okurth@vmware.com>
Date: Thu, 13 Feb 2020 00:49:09 +0000 (-0800)
Subject: lib/file: memory leak in File_WalkDirectoryNext
X-Git-Tag: stable-11.1.0~75
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6310fb3128bb347bcff49af65a5bee315eb1ccc3;p=thirdparty%2Fopen-vm-tools.git

lib/file: memory leak in File_WalkDirectoryNext

During a sequence of POSIX readdir calls it is possible for a directory
to be rearranged and a file that was previously reported may be found
again.  The code that protects the caller from seeing this isn't freeing
the file name string if a duplicate is discovered.  Fix this.
---

diff --git a/open-vm-tools/lib/file/filePosix.c b/open-vm-tools/lib/file/filePosix.c
index 1970e273e..8ad4d14c1 100644
--- a/open-vm-tools/lib/file/filePosix.c
+++ b/open-vm-tools/lib/file/filePosix.c
@@ -1,5 +1,5 @@
 /*********************************************************
- * Copyright (C) 2006-2019 VMware, Inc. All rights reserved.
+ * Copyright (C) 2006-2020 VMware, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU Lesser General Public License as published
@@ -3005,7 +3005,7 @@ File_WalkDirectoryStart(const char *dirName)  // IN:
 /*
  *-----------------------------------------------------------------------------
  *
- * File_WalkDirectoryNextEntry --
+ * File_WalkDirectoryNext --
  *
  *      Get the next file name during a directory traversal started with
  *      File_WalkDirectoryStart.
@@ -3079,15 +3079,15 @@ File_WalkDirectoryNext(WalkDirContext context,  // IN:
                                        UNICODE_SUBSTITUTION_CHAR);
       }
 
-      if (HashTable_Insert(context->hash, allocName, NULL)) {
+      if (HashTable_Insert(context->hash, allocName, NULL)) {  // Unique - good
          if (fileName != NULL) {
             *fileName = Util_SafeStrdup(allocName);
          }
 
          callAgain = TRUE;
          break;
-      } else {
-         /* Ignore duplicates */
+      } else {  // Duplicate - ignore
+         free(allocName);
          continue;
       }
    }