From 7a1085292deb832d7cbf6b0e8f64b8253c3f2a78 Mon Sep 17 00:00:00 2001

From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>

Date: Tue, 13 Feb 2018 16:56:10 +0200

Subject: [PATCH] Fix double free in rlm_sql acct_redundant

Do not free "expanded" buffer twice in "acct_redundant" in rlm_sql.c.

This fixes a crash in the case of an accounting packet not matching a

Start entry in the database.

See also https://bugzilla.redhat.com/show_bug.cgi?id=1540580

Found and fixed by Benoit Welterlen.

---

 src/modules/rlm_sql/rlm_sql.c | 1 -

 1 file changed, 1 deletion(-)

diff --git a/src/modules/rlm_sql/rlm_sql.c b/src/modules/rlm_sql/rlm_sql.c

index 3a032d32e..11f6c5d4c 100644

--- a/src/modules/rlm_sql/rlm_sql.c

+++ b/src/modules/rlm_sql/rlm_sql.c

@@ -1439,7 +1439,6 @@ static int acct_redundant(rlm_sql_t *inst, REQUEST *request, sql_acct_section_t

 		if (!*expanded) {

 			RDEBUG("Ignoring null query");

 			rcode = RLM_MODULE_NOOP;

-			talloc_free(expanded);

 			goto finish;

 		}

-- 

2.16.1