From 7a1085292deb832d7cbf6b0e8f64b8253c3f2a78 Mon Sep 17 00:00:00 2001 From: Nikolai Kondrashov Date: Tue, 13 Feb 2018 16:56:10 +0200 Subject: [PATCH] Fix double free in rlm_sql acct_redundant Do not free "expanded" buffer twice in "acct_redundant" in rlm_sql.c. This fixes a crash in the case of an accounting packet not matching a Start entry in the database. See also https://bugzilla.redhat.com/show_bug.cgi?id=1540580 Found and fixed by Benoit Welterlen. --- src/modules/rlm_sql/rlm_sql.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/modules/rlm_sql/rlm_sql.c b/src/modules/rlm_sql/rlm_sql.c index 3a032d32e..11f6c5d4c 100644 --- a/src/modules/rlm_sql/rlm_sql.c +++ b/src/modules/rlm_sql/rlm_sql.c @@ -1439,7 +1439,6 @@ static int acct_redundant(rlm_sql_t *inst, REQUEST *request, sql_acct_section_t if (!*expanded) { RDEBUG("Ignoring null query"); rcode = RLM_MODULE_NOOP; - talloc_free(expanded); goto finish; } -- 2.16.1