summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2006-03-07 19:18:56 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 11:11:02 -0500
commit2615b079f04903a80e02334a78961a54f915d063 (patch)
tree009817345d9123340d371754032ad5b4c04aaee6
parent71272fc441d7930f7ae810ee3c8f5a58385cb55c (diff)
downloadsamba-2615b079f04903a80e02334a78961a54f915d063.tar.gz
samba-2615b079f04903a80e02334a78961a54f915d063.tar.bz2
samba-2615b079f04903a80e02334a78961a54f915d063.zip
r13978: Here is why it's essential to use SAFE_FREE instead of free.
If we use free(data.dptr) and then the subsequent tdb_open fails in _reg_perfcount_get_counter_data() then data.dptr is left as a non-zero pointer that has been freed. This would cause it to be reused later on. Coverity bug #162. Jeremy. (This used to be commit 053efc20981e0280c6af0ebb9e17cea07da85fe8)
-rw-r--r--source3/registry/reg_perfcount.c12
1 files changed, 6 insertions, 6 deletions
diff --git a/source3/registry/reg_perfcount.c b/source3/registry/reg_perfcount.c
index 9b631736d6..7f9e9ad662 100644
--- a/source3/registry/reg_perfcount.c
+++ b/source3/registry/reg_perfcount.c
@@ -499,7 +499,7 @@ static BOOL _reg_perfcount_get_counter_info(PERF_DATA_BLOCK *block,
obj->counters[obj->NumCounters].CounterType = atoi(buf);
DEBUG(10, ("_reg_perfcount_get_counter_info: Got type [%d] for counter [%d].\n",
obj->counters[obj->NumCounters].CounterType, CounterIndex));
- free(data.dptr);
+ SAFE_FREE(data.dptr);
/* Fetch the actual data */
_reg_perfcount_make_key(&key, buf, PERFCOUNT_MAX_LEN, CounterIndex, "");
@@ -544,7 +544,7 @@ static BOOL _reg_perfcount_get_counter_info(PERF_DATA_BLOCK *block,
memset(buf, 0, PERFCOUNT_MAX_LEN);
memcpy(buf, data.dptr, data.dsize);
}
- free(data.dptr);
+ SAFE_FREE(data.dptr);
obj->counter_data.ByteLength += dsize + padding;
obj->counter_data.data = TALLOC_REALLOC_ARRAY(ps->mem_ctx,
@@ -694,7 +694,7 @@ BOOL _reg_perfcount_get_instance_info(PERF_INSTANCE_DEFINITION *inst,
return False;
memset(inst->counter_data.data, 0, data.dsize);
memcpy(inst->counter_data.data, data.dptr, data.dsize);
- free(data.dptr);
+ SAFE_FREE(data.dptr);
/* Fetch instance name */
memset(temp, 0, PERFCOUNT_MAX_LEN);
@@ -719,7 +719,7 @@ BOOL _reg_perfcount_get_instance_info(PERF_INSTANCE_DEFINITION *inst,
uint8,
inst->NameLength);
memcpy(inst->data, name, inst->NameLength);
- free(data.dptr);
+ SAFE_FREE(data.dptr);
}
inst->ParentObjectTitleIndex = 0;
@@ -807,7 +807,7 @@ static int _reg_perfcount_assemble_global(PERF_DATA_BLOCK *block,
DEBUG(3, ("_reg_perfcount_assemble_global: Failed to add new relationship for counter [%d].\n", j));
retval = -1;
}
- free(data.dptr);
+ SAFE_FREE(data.dptr);
}
else
DEBUG(3, ("NULL relationship for counter [%d] using key [%s].\n", j, keybuf));
@@ -837,7 +837,7 @@ static BOOL _reg_perfcount_get_64(SMB_BIG_UINT *retval,
memset(buf, 0, PERFCOUNT_MAX_LEN);
memcpy(buf, data.dptr, data.dsize);
- free(data.dptr);
+ SAFE_FREE(data.dptr);
*retval = atof(buf);