mir/ovs
2
0
Fork 0
mirror of https://github.com/openvswitch/ovs synced 2025-08-31 14:25:26 +00:00
Code Issues Releases Wiki Activity

dpif-netlink: Fix multiple-free and fd leak on error path.

Browse Source 
This function attempts to open a bunch of new handlers.  If it fails, it
attempts to close all the handlers that have already been opened.
Unfortunately, the loop to close the opened handlers used the wrong array
index: 'i' instead of 'j'.  This fixes the problem.

Found by Coverity.

Reported-at: https://scan3.coverity.com/reports.htm#v16889/p10449/fileInstanceId=14762827&defectInstanceId=4305351&mergedDefectId=180429
Signed-off-by: Ben Pfaff <blp@ovn.org>
Acked-by: Justin Pettit <jpettit@ovn.org>
This commit is contained in:
Ben Pfaff
2017-05-30 07:38:56 -07:00
parent f7f37d192f
commit aa5c021607
1 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
lib/dpif-netlink.c
View File

@@ -1,5 +1,5 @@
/*
* Copyright (c) 2008, 2009, 2010, 2011, 2012, 2013, 2014, 2015, 2016 Nicira, Inc.
* Copyright (c) 2008-2017 Nicira, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -1884,10 +1884,9 @@ dpif_netlink_refresh_channels(struct dpif_netlink *dpif, uint32_t n_handlers)
error = dpif_netlink_handler_init(handler);
if (error) {
size_t j;
struct dpif_handler *tmp = &dpif->handlers[i];
for (j = 0; j < i; j++) {
struct dpif_handler *tmp = &dpif->handlers[j];
dpif_netlink_handler_uninit(tmp);
}
free(dpif->handlers);