diff options
| author | Jeremy Allison <jra@samba.org> | 2006-03-07 19:18:56 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 11:11:02 -0500 |
| commit | 2615b079f04903a80e02334a78961a54f915d063 (patch) | |
| tree | 009817345d9123340d371754032ad5b4c04aaee6 | |
| parent | 71272fc441d7930f7ae810ee3c8f5a58385cb55c (diff) | |
| download | samba-2615b079f04903a80e02334a78961a54f915d063.tar.gz samba-2615b079f04903a80e02334a78961a54f915d063.tar.bz2 samba-2615b079f04903a80e02334a78961a54f915d063.zip | |
r13978: Here is why it's essential to use SAFE_FREE instead of free.
If we use free(data.dptr) and then the subsequent tdb_open
fails in _reg_perfcount_get_counter_data() then data.dptr
is left as a non-zero pointer that has been freed. This would
cause it to be reused later on. Coverity bug #162.
Jeremy.
(This used to be commit 053efc20981e0280c6af0ebb9e17cea07da85fe8)
| -rw-r--r-- | source3/registry/reg_perfcount.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/source3/registry/reg_perfcount.c b/source3/registry/reg_perfcount.c index 9b631736d6..7f9e9ad662 100644 --- a/source3/registry/reg_perfcount.c +++ b/source3/registry/reg_perfcount.c @@ -499,7 +499,7 @@ static BOOL _reg_perfcount_get_counter_info(PERF_DATA_BLOCK *block, obj->counters[obj->NumCounters].CounterType = atoi(buf); DEBUG(10, ("_reg_perfcount_get_counter_info: Got type [%d] for counter [%d].\n", obj->counters[obj->NumCounters].CounterType, CounterIndex)); - free(data.dptr); + SAFE_FREE(data.dptr); /* Fetch the actual data */ _reg_perfcount_make_key(&key, buf, PERFCOUNT_MAX_LEN, CounterIndex, ""); @@ -544,7 +544,7 @@ static BOOL _reg_perfcount_get_counter_info(PERF_DATA_BLOCK *block, memset(buf, 0, PERFCOUNT_MAX_LEN); memcpy(buf, data.dptr, data.dsize); } - free(data.dptr); + SAFE_FREE(data.dptr); obj->counter_data.ByteLength += dsize + padding; obj->counter_data.data = TALLOC_REALLOC_ARRAY(ps->mem_ctx, @@ -694,7 +694,7 @@ BOOL _reg_perfcount_get_instance_info(PERF_INSTANCE_DEFINITION *inst, return False; memset(inst->counter_data.data, 0, data.dsize); memcpy(inst->counter_data.data, data.dptr, data.dsize); - free(data.dptr); + SAFE_FREE(data.dptr); /* Fetch instance name */ memset(temp, 0, PERFCOUNT_MAX_LEN); @@ -719,7 +719,7 @@ BOOL _reg_perfcount_get_instance_info(PERF_INSTANCE_DEFINITION *inst, uint8, inst->NameLength); memcpy(inst->data, name, inst->NameLength); - free(data.dptr); + SAFE_FREE(data.dptr); } inst->ParentObjectTitleIndex = 0; @@ -807,7 +807,7 @@ static int _reg_perfcount_assemble_global(PERF_DATA_BLOCK *block, DEBUG(3, ("_reg_perfcount_assemble_global: Failed to add new relationship for counter [%d].\n", j)); retval = -1; } - free(data.dptr); + SAFE_FREE(data.dptr); } else DEBUG(3, ("NULL relationship for counter [%d] using key [%s].\n", j, keybuf)); @@ -837,7 +837,7 @@ static BOOL _reg_perfcount_get_64(SMB_BIG_UINT *retval, memset(buf, 0, PERFCOUNT_MAX_LEN); memcpy(buf, data.dptr, data.dsize); - free(data.dptr); + SAFE_FREE(data.dptr); *retval = atof(buf); |