From: Simon Marchi Date: Wed, 16 Oct 2019 20:45:22 +0000 (-0400) Subject: Fix: avoid double-free in build_index_from_idx_file X-Git-Url: http://git.efficios.com/?p=babeltrace.git;a=commitdiff_plain;h=f35a48bc5c6a73d05cc441bc34d4371e27265679 Fix: avoid double-free in build_index_from_idx_file If the validation at the end of build_index_from_idx_file fails, the index_entry variable will still point to the last processed index entry. That same entry will also have been added to the index->entries array. In the error path, we free index_entry and the index object, which frees that index entry twice. Fix it by clearing index_entry after adding the entry to the index object (the ownership is conceptually transferred). I don't add a test with this patch, because the file that triggers this bug now hits a bug further in the processing. That file will be added in the testsuite when it will no longer make babeltrace crash. Change-Id: I091785895541105273c5d07d49f35628c2682e30 Signed-off-by: Simon Marchi Reviewed-on: https://review.lttng.org/c/babeltrace/+/2211 Reviewed-by: Francis Deslauriers CI-Build: Francis Deslauriers Tested-by: jenkins --- diff --git a/src/plugins/ctf/fs-src/data-stream-file.c b/src/plugins/ctf/fs-src/data-stream-file.c index 4f2c8375..5f811214 100644 --- a/src/plugins/ctf/fs-src/data-stream-file.c +++ b/src/plugins/ctf/fs-src/data-stream-file.c @@ -448,8 +448,11 @@ struct ctf_fs_ds_index *build_index_from_idx_file( total_packets_size += packet_size; file_pos += file_index_entry_size; - g_ptr_array_add(index->entries, index_entry); prev_index_entry = index_entry; + + /* Give ownership of `index_entry` to `index->entries`. */ + g_ptr_array_add(index->entries, index_entry); + index_entry = NULL; } /* Validate that the index addresses the complete stream. */