diff options
| author | Ben Pfaff <blp@nicira.com> | 2013-01-24 12:27:53 -0800 |
|---|---|---|
| committer | Ben Pfaff <blp@nicira.com> | 2013-01-24 12:35:40 -0800 |
| commit | 105a1df61ccf9063b3141d68cb8bb781d8cc8e9b (patch) | |
| tree | 047121d57c4a5bf059abddac19d6a91913b5dbb4 | |
| parent | e3ba2dfba8760dd698a3b9cc3a563d8e944f06a5 (diff) | |
| download | openvswitch-105a1df61ccf9063b3141d68cb8bb781d8cc8e9b.tar.gz | |
ovsdb: Fix double-free in ovsdb_jsonrpc_session_close().
ovsdb_session_destroy() was called twice but it should only be called once.
This double-free is unlikely to cause problems in practice because it only
triggers if there were ever more than two outstanding requests in the
session at a time (because the only data being freed is an hmap, which
does not allocate any heap memory unless the hmap has more than two
elements).
Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Ethan Jackson <ethan@nicira.com>
| -rw-r--r-- | ovsdb/jsonrpc-server.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/ovsdb/jsonrpc-server.c b/ovsdb/jsonrpc-server.c index 0cc8bdf9f..99c11d494 100644 --- a/ovsdb/jsonrpc-server.c +++ b/ovsdb/jsonrpc-server.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2009, 2010, 2011, 2012 Nicira, Inc. +/* Copyright (c) 2009, 2010, 2011, 2012, 2013 Nicira, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -349,7 +349,6 @@ ovsdb_jsonrpc_session_close(struct ovsdb_jsonrpc_session *s) ovsdb_jsonrpc_session_unlock_all(s); jsonrpc_session_close(s->js); list_remove(&s->node); - ovsdb_session_destroy(&s->up); s->remote->server->n_sessions--; ovsdb_session_destroy(&s->up); free(s); |