git: 4c79391a7fa4 - stable/13 - libnv: fix double free

Mariusz Zaborski oshogbo at FreeBSD.org
Tue Jul 6 17:53:26 UTC 2021


The branch stable/13 has been updated by oshogbo:

URL: https://cgit.FreeBSD.org/src/commit/?id=4c79391a7fa47c22429d0f9c8877a27065794cf1

commit 4c79391a7fa47c22429d0f9c8877a27065794cf1
Author:     Mariusz Zaborski <oshogbo at FreeBSD.org>
AuthorDate: 2019-02-17 18:26:27 +0000
Commit:     Mariusz Zaborski <oshogbo at FreeBSD.org>
CommitDate: 2021-07-06 17:53:08 +0000

    libnv: fix double free
    
    In r343986 we introduced a double free. The structure was already
    freed fixed in the r302966. This problem was introduced
    because the GitHub version was out of sync with the FreeBSD one.
    
    Submitted by:   Mindaugas Rasiukevicius <rmind at netbsd.org>
    MFC with:       r343986
    
    (cherry picked from commit d97753b5c8f1d32fbcdcbb0d129b49f808245865)
---
 sys/contrib/libnv/bsd_nvpair.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/sys/contrib/libnv/bsd_nvpair.c b/sys/contrib/libnv/bsd_nvpair.c
index 556203f740fc..34ea8c6bc1d5 100644
--- a/sys/contrib/libnv/bsd_nvpair.c
+++ b/sys/contrib/libnv/bsd_nvpair.c
@@ -229,14 +229,6 @@ nvpair_remove_nvlist_array(nvpair_t *nvp)
 	nvlarray = __DECONST(nvlist_t **,
 	    nvpair_get_nvlist_array(nvp, &count));
 	for (i = 0; i < count; i++) {
-		nvlist_t *nvl;
-		nvpair_t *nnvp;
-
-		nvl = nvlarray[i];
-		nnvp = nvlist_get_array_next_nvpair(nvl);
-		if (nnvp != NULL) {
-			nvpair_free_structure(nnvp);
-		}
 		nvlist_set_array_next(nvl, NULL);
 		nvlist_set_parent(nvl, NULL);
 	}


More information about the dev-commits-src-all mailing list