From 0b6a64ccceedba7c2b542217ec07891e0ab3f885 Mon Sep 17 00:00:00 2001 From: Ben Pfaff Date: Thu, 24 Jan 2013 12:27:53 -0800 Subject: [PATCH] ovsdb: Fix double-free in ovsdb_jsonrpc_session_close(). ovsdb_session_destroy() was called twice but it should only be called once. This double-free is unlikely to cause problems in practice because it only triggers if there were ever more than two outstanding requests in the session at a time (because the only data being freed is an hmap, which does not allocate any heap memory unless the hmap has more than two elements). Signed-off-by: Ben Pfaff Acked-by: Ethan Jackson --- ovsdb/jsonrpc-server.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ovsdb/jsonrpc-server.c b/ovsdb/jsonrpc-server.c index 1d0b0e316..6d07c45d2 100644 --- a/ovsdb/jsonrpc-server.c +++ b/ovsdb/jsonrpc-server.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2009, 2010, 2011, 2012 Nicira, Inc. +/* Copyright (c) 2009, 2010, 2011, 2012, 2013 Nicira, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -386,7 +386,6 @@ ovsdb_jsonrpc_session_close(struct ovsdb_jsonrpc_session *s) ovsdb_jsonrpc_session_unlock_all(s); jsonrpc_session_close(s->js); list_remove(&s->node); - ovsdb_session_destroy(&s->up); s->remote->server->n_sessions--; ovsdb_session_destroy(&s->up); free(s); -- 2.43.0