|
 |
a19bc6 |
From 45f3c8e04093a1ed871eb67aa4c1c28b11d3346c Mon Sep 17 00:00:00 2001
|
|
|
a19bc6 |
From: Jan Synacek <jan.synacek@gmail.com>
|
|
|
a19bc6 |
Date: Tue, 3 Jan 2017 21:34:36 +0100
|
|
|
a19bc6 |
Subject: [PATCH] shared: fix double free in unmask (#5005)
|
|
|
a19bc6 |
|
|
|
a19bc6 |
Easily reproducible:
|
|
|
a19bc6 |
1) systemctl mask foo
|
|
|
a19bc6 |
2) systemctl unmask foo foo
|
|
|
a19bc6 |
|
|
|
a19bc6 |
The problem here is that the *i that is put into todo[] is later freed
|
|
|
a19bc6 |
in strv_uniq(), which is not directly visible from this patch. Somewhere
|
|
|
a19bc6 |
further in the code, the string that *i pointed to is freed again. That
|
|
|
a19bc6 |
happens only when multiple services with the same name/path are specified.
|
|
|
a19bc6 |
|
|
|
a19bc6 |
(cherry picked from commit dc7dd61de610e9330abe7014860acfa733887d5e)
|
|
|
a19bc6 |
Resolves: #1409997
|
|
|
a19bc6 |
---
|
|
|
a19bc6 |
src/shared/install.c | 4 ++--
|
|
|
a19bc6 |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
a19bc6 |
|
|
|
a19bc6 |
diff --git a/src/shared/install.c b/src/shared/install.c
|
|
|
c62b8e |
index f01a212620..1b59a96b15 100644
|
|
|
a19bc6 |
--- a/src/shared/install.c
|
|
|
a19bc6 |
+++ b/src/shared/install.c
|
|
|
a19bc6 |
@@ -1602,7 +1602,7 @@ int unit_file_unmask(
|
|
|
a19bc6 |
|
|
|
a19bc6 |
_cleanup_set_free_free_ Set *remove_symlinks_to = NULL;
|
|
|
a19bc6 |
_cleanup_free_ char *config_path = NULL;
|
|
|
a19bc6 |
- _cleanup_free_ char **todo = NULL;
|
|
|
a19bc6 |
+ _cleanup_strv_free_ char **todo = NULL;
|
|
|
a19bc6 |
size_t n_todo = 0, n_allocated = 0;
|
|
|
a19bc6 |
char **i;
|
|
|
a19bc6 |
int r, q;
|
|
|
a19bc6 |
@@ -1639,7 +1639,7 @@ int unit_file_unmask(
|
|
|
a19bc6 |
if (!GREEDY_REALLOC0(todo, n_allocated, n_todo + 2))
|
|
|
a19bc6 |
return -ENOMEM;
|
|
|
a19bc6 |
|
|
|
a19bc6 |
- todo[n_todo++] = *i;
|
|
|
a19bc6 |
+ todo[n_todo++] = strdup(*i);
|
|
|
a19bc6 |
}
|
|
|
a19bc6 |
|
|
|
a19bc6 |
strv_uniq(todo);
|