From: Alan T. DeKok <aland@freeradius.org>
Date: Tue, 27 Apr 2021 11:40:50 +0000 (-0400)
Subject: don't access list after it's been freed
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1553d3b7dbb4f81e463cafbfe0ae0d3c458cb704;p=thirdparty%2Ffreeradius-server.git

don't access list after it's been freed

and don't free a list on parse error.  We rely instead on the
caller to free things.

If we do want to free the temporary lists while reading, we will
have to add a temporary context, OR walk down the temporary list
freeing each individual element.

The temporary lists are allocated on the stack, so we cannot
talloc_free() them.
---

diff --git a/src/lib/server/users_file.c b/src/lib/server/users_file.c
index 31f2560c8dd..4d7dfe8a456 100644
--- a/src/lib/server/users_file.c
+++ b/src/lib/server/users_file.c
@@ -90,7 +90,6 @@ static inline void line_error_marker_adj(char const *src_file, int src_line,
 void pairlist_free(PAIR_LIST_LIST *pl)
 {
 	talloc_free(pl);
-	pairlist_list_init(pl);
 }
 
 static fr_table_num_sorted_t const check_cmp_op_table[] = {
@@ -318,7 +317,6 @@ int pairlist_read(TALLOC_CTX *ctx, fr_dict_t const *dict, char const *file, PAIR
 		if (leading_spaces) {
 	    		ERROR_MARKER(&sbuff, "Entry does not begin with a user name");
 		fail:
-			pairlist_free(list);
 			fclose(fp);
 			return -1;
 		}