From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
Date: Tue, 13 Feb 2018 14:56:10 +0000 (+0200)
Subject: Fix double free in rlm_sql acct_redundant
X-Git-Tag: release_3_0_17~66^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c6f409bebbca5a48f4d01ac73e159775f3d38238;p=thirdparty%2Ffreeradius-server.git

Fix double free in rlm_sql acct_redundant

Do not free "expanded" buffer twice in "acct_redundant" in rlm_sql.c.
This fixes a crash in the case of an accounting packet not matching a
Start entry in the database.

See also https://bugzilla.redhat.com/show_bug.cgi?id=1540580

Found and fixed by Benoit Welterlen.
---

diff --git a/src/modules/rlm_sql/rlm_sql.c b/src/modules/rlm_sql/rlm_sql.c
index 3bf9be2fc39..1b8f826ad1f 100644
--- a/src/modules/rlm_sql/rlm_sql.c
+++ b/src/modules/rlm_sql/rlm_sql.c
@@ -1439,7 +1439,6 @@ static int acct_redundant(rlm_sql_t *inst, REQUEST *request, sql_acct_section_t
 		if (!*expanded) {
 			RDEBUG("Ignoring null query");
 			rcode = RLM_MODULE_NOOP;
-			talloc_free(expanded);
 
 			goto finish;
 		}