I didn't try to trigger the double free, but it looks feasible.
>From 864cc161ffaf6c08cb980e66a673b53ac5ea52ab Mon Sep 17 00:00:00 2001
From: Jim Meyering <meyering@xxxxxxxxxx>
Date: Mon, 14 Dec 2009 14:34:29 +0100
Subject: [PATCH] virsh: avoid double-free
* tools/virsh.c (vshCommandParse): Avoid double-free of "tkdata".
Set it to NULL immediately after free in the (cmd == NULL) case,
just as in the other case, in case the final free(tkdata) is
triggered by a syntax error.
---
tools/virsh.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/tools/virsh.c b/tools/virsh.c
index 62c1270..0312945 100644
--- a/tools/virsh.c
+++ b/tools/virsh.c
@@ -8044,6 +8044,7 @@ vshCommandParse(vshControl *ctl, char *cmdstr)
goto syntaxError; /* ... or ignore this command only? */
}
free(tkdata);
+ tkdata = NULL;
} else if (tk == VSH_TK_OPTION) {
if (!(opt = vshCmddefGetOption(cmd, tkdata))) {
vshError(ctl,
--
1.6.6.rc2.275.g51e2d
--
Libvir-list mailing list
Libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list