[ovs-dev] [PATCH 2/5] ovsdb: Fix double-free in ovsdb_jsonrpc_session_close().

Ben Pfaff blp at nicira.com
Thu Jan 24 19:47:57 UTC 2013


ovsdb_session_destroy() was called twice but it should only be called once.

This double-free is unlikely to cause problems in practice because it only
triggers if there were ever more than two outstanding requests in the
session at a time (because the only data being freed is an hmap, which
does not allocate any heap memory unless the hmap has more than two
elements).

Signed-off-by: Ben Pfaff <blp at nicira.com>
---
 ovsdb/jsonrpc-server.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)

diff --git a/ovsdb/jsonrpc-server.c b/ovsdb/jsonrpc-server.c
index 1d0b0e3..6d07c45 100644
--- a/ovsdb/jsonrpc-server.c
+++ b/ovsdb/jsonrpc-server.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2009, 2010, 2011, 2012 Nicira, Inc.
+/* Copyright (c) 2009, 2010, 2011, 2012, 2013 Nicira, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -386,7 +386,6 @@ ovsdb_jsonrpc_session_close(struct ovsdb_jsonrpc_session *s)
     ovsdb_jsonrpc_session_unlock_all(s);
     jsonrpc_session_close(s->js);
     list_remove(&s->node);
-    ovsdb_session_destroy(&s->up);
     s->remote->server->n_sessions--;
     ovsdb_session_destroy(&s->up);
     free(s);
-- 
1.7.2.5




More information about the dev mailing list