[oh-tracker] [ openhpi-Bugs-3613756 ] potential double free() in oa_soap_event_thread()

[SourceForge.net <no...@so...>]

Bugs item #3613756, was opened at 2013-05-22 15:54
Message generated for change (Comment added) made by hemanthreddy
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=532251&aid=3613756&group_id=71730

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: HP c-Class Plugin
>Group: 3.3.x
Status: Open
>Resolution: Accepted
Priority: 5
Private: No
Submitted By: Michele Baldessari (mbaldessari)
Assigned to: Hemantha Beecherla (hemanthreddy)
Summary: potential double free() in oa_soap_event_thread()

Initial Comment:
There is a potential double free going on in this function (should listen_for_events not be == to SAHPI_TRUE). Let's make it more robust:

diff --git a/openhpi/trunk/plugins/oa_soap/oa_soap_event.c b/openhpi/trunk/plugins/oa_soap/oa_soap_event.c
index 986b6e8..2d2947b 100644
--- a/openhpi/trunk/plugins/oa_soap/oa_soap_event.c
+++ b/openhpi/trunk/plugins/oa_soap/oa_soap_event.c
@@ -223,6 +223,7 @@ gpointer oa_soap_event_thread(gpointer oa_pointer)
                         sleep(2);
         }
         free(url);
+       url = NULL;
 
         /* Intialize the event request structure */
         request.pid = oa->event_pid;
@@ -304,7 +305,7 @@ oa->event_con2 failed\n");
                 } /* end of else (SOAP call failure handling) */
 
         } /* end of 'while(listen_for_events == SAHPI_TRUE)' loop */
-        free(url);
+        if (url != NULL) free(url);
         return (gpointer *) SA_OK;
 }
 


----------------------------------------------------------------------

>Comment By: Hemantha Beecherla (hemanthreddy)
Date: 2013-05-24 11:43

Message:
Thanks for filing the this bug,

Below check is not necessary to free url. 

- free(url);
+ if (url != NULL) free(url);

The final patch look like below,

Index: plugins/oa_soap/oa_soap_event.c
===================================================================
--- plugins/oa_soap/oa_soap_event.c     (revision 7539)
+++ plugins/oa_soap/oa_soap_event.c     (working copy)
@@ -223,6 +223,7 @@
                         sleep(2);
         }
         free(url);
+        url = NULL;

         /* Intialize the event request structure */
         request.pid = oa->event_pid;




----------------------------------------------------------------------

Comment By: dr_mohan (dr_mohan)
Date: 2013-05-23 16:16

Message:
url needs to be set to NULL after free.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=532251&aid=3613756&group_id=71730