[image] Clear recorded replacement image immediately after consuming

If an embedded script uses "chain --replace", the embedded image will
retain a reference to the replacement image in perpetuity.

Fix by clearing any recorded replacement image immediately in
image_exec(), instead of relying upon image_free() to drop the
reference.

Signed-off-by: Michael Brown <mcb30@ipxe.org>

diff --git a/src/core/image.c b/src/core/image.c
index a49ca7e1d3325fa4c82732ac9ae92b663fbd2d8f..72885ec09f3a494bf6eae6d4615309acae9b1076 100644 (file)
--- a/src/core/image.c
+++ b/src/core/image.c
@@ -447,6 +447,10 @@ int image_exec ( struct image *image ) {
        if ( replacement )
                assert ( replacement->flags & IMAGE_REGISTERED );
 
+       /* Clear any recorded replacement image */
+       image_put ( image->replacement );
+       image->replacement = NULL;
+
  err:
        /* Unregister image if applicable */
        if ( image->flags & IMAGE_AUTO_UNREGISTER )