diff options
| author | Yu Watanabe <watanabe.yu+github@gmail.com> | 2022-12-12 14:16:09 +0900 |
|---|---|---|
| committer | Yu Watanabe <watanabe.yu+github@gmail.com> | 2022-12-12 14:20:47 +0900 |
| commit | eb18e7b7825e8320bb4d6269690ef8c3f5461d2b (patch) | |
| tree | 624ccaed9d00ade1e7de3ffde0bd2e6a3b62e85f | |
| parent | 4113a3e0f379a84c43a7b6b121e00022e9836bb7 (diff) | |
| download | systemd-eb18e7b7825e8320bb4d6269690ef8c3f5461d2b.tar.gz | |
sd-device: fix double-free
If an attribute is read but the value is not used (i.e. ret_value is NULL),
then sd_device_get_sysattr_value() mistakenly frees the read data even though
it is cached internally.
Fixes a bug introduced by acfc2a1d15560084e077ffb3be472cd117e9020a.
Fixes #25702.
| -rw-r--r-- | src/libsystemd/sd-device/sd-device.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/src/libsystemd/sd-device/sd-device.c b/src/libsystemd/sd-device/sd-device.c index 55a0ee730e..9c4743f055 100644 --- a/src/libsystemd/sd-device/sd-device.c +++ b/src/libsystemd/sd-device/sd-device.c @@ -2332,9 +2332,14 @@ _public_ int sd_device_get_sysattr_value(sd_device *device, const char *sysattr, sysattr, value, ret_value ? "" : ", ignoring"); if (ret_value) return r; - } else if (ret_value) - *ret_value = TAKE_PTR(value); + return 0; + } + + if (ret_value) + *ret_value = value; + + TAKE_PTR(value); return 0; } |