Merge pull request #202 from lioyerar/fix_coredump_db

kravietz · web-flow · commit b89dba44b58e · 2023-10-12T07:44:26.000+01:00
libtac: fix double free in tac_acct_read_timeout
diff --git a/libtac/lib/acct_r.c b/libtac/lib/acct_r.c
@@ -139,8 +139,7 @@ int tac_acct_read_timeout(int fd, struct areply *re, unsigned long timeout)
         msg = (char *)xcalloc(1, tb->msg_len + 1);
         memcpy(msg, (unsigned char *)tb + TAC_ACCT_REPLY_FIXED_FIELDS_SIZE, tb->msg_len);
         msg[(int)tb->msg_len] = '\0';
-        re->msg = msg;
-        free(msg);
+        re->msg = msg; /* Freed by caller */
     }
 
     /* server logged our request successfully */

Original file line number	Diff line number	Diff line change
`@@ -139,8 +139,7 @@ int tac_acct_read_timeout(int fd, struct areply *re, unsigned long timeout)`
`139`	`139`	`msg = (char *)xcalloc(1, tb->msg_len + 1);`
`140`	`140`	`memcpy(msg, (unsigned char *)tb + TAC_ACCT_REPLY_FIXED_FIELDS_SIZE, tb->msg_len);`
`141`	`141`	`msg[(int)tb->msg_len] = '\0';`
`142`		`- re->msg = msg;`
`143`		`- free(msg);`
	`142`	`+ re->msg = msg; /* Freed by caller */`
`144`	`143`	`}`
`145`	`144`
`146`	`145`	`/* server logged our request successfully */`