[SSSD] [PATCH] Avoid accessing half-deallocated memory when using talloc_zfree macro
Eugene Indenbom
eindenbom at gmail.com
Fri Apr 16 06:02:13 UTC 2010
The current implementation of talloc_zfree macro has a substantial
deficiency: it deallocates memory first and then clears a pointer.
Clearing pointer after deallocation completes could lead to bad side
effects when callbacks are called during object destruction: the
callback called from destructor could dereference half-destroyed object
referenced by the yet-not-cleared pointer.
The above could lead to disastrous effects including memory double free.
The patch attached fixes the issues by using correct free sequence:
clear pointer first, then deallocate memory block.
Eugene
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: 0001-Avoid-accessing-half-deallocated-memory-when-using-t.patch
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100416/680ef218/attachment.ksh>
More information about the sssd-devel
mailing list