clearlinux/systemd-stable
2
0
Fork 0
mirror of https://github.com/clearlinux/systemd-stable.git synced 2026-09-04 20:51:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

sd-bus: fix use-after-free in close_kdbus_msg()

Browse Source 
Walk the items first, then free the memory of the message.

Also, while at it, make coverity happy with an explicit (void) prefix.
We intentionally ignore the return value here.
This commit is contained in:
Daniel Mack
2014-10-07 11:38:31 +02:00
parent 4e3deeedc1
commit ca794c8e95
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libsystemd/sd-bus/bus-kernel.c
+2 -2
View File
@@ -808,8 +808,6 @@ static void close_kdbus_msg(sd_bus *bus, struct kdbus_msg *k) {
cmd.flags = 0;
cmd.offset = (uint8_t *)k - (uint8_t *)bus->kdbus_buffer;
ioctl(bus->input_fd, KDBUS_CMD_FREE, &cmd);
KDBUS_ITEM_FOREACH(d, k, items) {
if (d->type == KDBUS_ITEM_FDS)
@@ -817,6 +815,8 @@ static void close_kdbus_msg(sd_bus *bus, struct kdbus_msg *k) {
else if (d->type == KDBUS_ITEM_PAYLOAD_MEMFD)
safe_close(d->memfd.fd);
}
(void) ioctl(bus->input_fd, KDBUS_CMD_FREE, &cmd);
}
int bus_kernel_write_message(sd_bus *bus, sd_bus_message *m, bool hint_sync_call) {