hcq/MaxScale
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix use-after-free in buffer.c

Browse Source 
The fix to MXS-1338 added a bug where the buffer objects were freed after
the shared buffer was freed.
This commit is contained in:
Markus Mäkelä
2017-08-02 17:55:35 +03:00
parent 63b16243e7
commit bda1c5d55d
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
server/core/buffer.c
View File

@ -257,8 +257,6 @@ gwbuf_free_one(GWBUF *buf)
if (atomic_add(&buf->sbuf->refcount, -1) == 1) if (atomic_add(&buf->sbuf->refcount, -1) == 1)
{ {
MXS_FREE(buf->sbuf->data);
MXS_FREE(buf->sbuf);
bo = buf->sbuf->bufobj; bo = buf->sbuf->bufobj;
while (bo != NULL) while (bo != NULL)
@ -266,7 +264,10 @@ gwbuf_free_one(GWBUF *buf)
bo = gwbuf_remove_buffer_object(buf, bo); bo = gwbuf_remove_buffer_object(buf, bo);
} }
MXS_FREE(buf->sbuf->data);
MXS_FREE(buf->sbuf);
} }
while (buf->properties) while (buf->properties)
{ {
prop = buf->properties; prop = buf->properties;