From: Oliver Kurth <okurth@vmware.com>
Date: Fri, 27 Jul 2018 18:46:23 +0000 (-0700)
Subject: [tools] Cleanup RpcOut reply after send failure
X-Git-Tag: stable-11.0.0~487
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=def5e3aa8cb0ba5457cf5147e32f80eec8556f49;p=thirdparty%2Fopen-vm-tools.git

[tools] Cleanup RpcOut reply after send failure

There is a path in RpcOut that does not clear the reply message
after a failure.  This can cause the invoker to trigger a free()
failure.
---

diff --git a/open-vm-tools/lib/rpcOut/rpcout.c b/open-vm-tools/lib/rpcOut/rpcout.c
index a59ce66cd..b98dc92ba 100644
--- a/open-vm-tools/lib/rpcOut/rpcout.c
+++ b/open-vm-tools/lib/rpcOut/rpcout.c
@@ -439,7 +439,9 @@ RpcOutSendOneRawWork(void *request,         // IN: RPCI command
          memcpy(callerReply, myReply, s);
          callerReply[s] = '\0';
       }
-
+      if (reply != NULL) {
+         *reply = NULL;
+      }
       return FALSE;
    }