33 lines
938 B
Diff
33 lines
938 B
Diff
commit 1d2e10afb2ffc35cb3623f57a15f712359f18e75
|
|
Author: Herb Wartens <wartens2@llnl.gov>
|
|
Date: Tue Aug 1 10:36:16 2023 -0400
|
|
|
|
rpcb_clnt.c: Eliminate double frees in delete_cache()
|
|
|
|
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2224666
|
|
Signed-off-by: Steve Dickson <steved@redhat.com>
|
|
|
|
diff --git a/src/rpcb_clnt.c b/src/rpcb_clnt.c
|
|
index c0a9e12..68fe69a 100644
|
|
--- a/src/rpcb_clnt.c
|
|
+++ b/src/rpcb_clnt.c
|
|
@@ -262,12 +262,15 @@ delete_cache(addr)
|
|
for (cptr = front; cptr != NULL; cptr = cptr->ac_next) {
|
|
if (!memcmp(cptr->ac_taddr->buf, addr->buf, addr->len)) {
|
|
/* Unlink from cache. We'll destroy it after releasing the mutex. */
|
|
- if (cptr->ac_uaddr)
|
|
+ if (cptr->ac_uaddr) {
|
|
free(cptr->ac_uaddr);
|
|
- if (prevptr)
|
|
+ cptr->ac_uaddr = NULL;
|
|
+ }
|
|
+ if (prevptr) {
|
|
prevptr->ac_next = cptr->ac_next;
|
|
- else
|
|
+ } else {
|
|
front = cptr->ac_next;
|
|
+ }
|
|
cachesize--;
|
|
break;
|
|
}
|