[SSSD] [PATCH] Avoid accessing half-deallocated memory when using talloc_zfree macro

Eugene Indenbom eindenbom at gmail.com
Fri Apr 16 06:02:13 UTC 2010


The current implementation of talloc_zfree macro has a substantial 
deficiency: it deallocates memory first and then clears a pointer.

Clearing pointer after deallocation completes could lead to bad side 
effects when callbacks are called during object destruction: the 
callback called from destructor could dereference half-destroyed object 
referenced by the yet-not-cleared pointer.

The above could lead to disastrous effects including memory double free.

The patch attached fixes the issues by using correct free sequence: 
clear pointer first, then deallocate memory block.

Eugene
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: 0001-Avoid-accessing-half-deallocated-memory-when-using-t.patch
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100416/680ef218/attachment.ksh>


More information about the sssd-devel mailing list