stv0g/libnl
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

idiag: fix idiagnl_msg_clone()

Browse source 
For one, we did not clone all pointer values. Hence, every cloned
object was very broken and resulted in dangling pointers and
double free/unref.

Apparently nobody was really using this function up to now.

Also, fix the return cases for NLE_NOMEM, so that we did not assume
ownership of pointers in 'src'.

Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Thomas Haller <thaller@redhat.com>
This commit is contained in:
Thomas Haller 2014-11-24 17:14:54 +01:00
parent f40fd71701
commit 39ca54ab4d
1 changed files with 25 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
lib/idiag/idiag_msg_obj.c
View file

@ -572,13 +572,36 @@ static int idiagnl_msg_clone(struct nl_object *_dst, struct nl_object *_src)
struct idiagnl_msg *dst = (struct idiagnl_msg *) _dst;
struct idiagnl_msg *src = (struct idiagnl_msg *) _src;
if (src->idiag_src)
dst->idiag_cong = NULL;
dst->idiag_src = NULL;
dst->idiag_dst = NULL;
dst->idiag_meminfo = NULL;
dst->idiag_vegasinfo = NULL;
if (src->idiag_cong) {
if (!(dst->idiag_cong = strdup(src->idiag_cong)))
return -NLE_NOMEM;
}
if (src->idiag_src) {
if (!(dst->idiag_src = nl_addr_clone(src->idiag_src)))
return -NLE_NOMEM;
}
if (src->idiag_dst)
if (src->idiag_dst) {
if (!(dst->idiag_dst = nl_addr_clone(src->idiag_dst)))
return -NLE_NOMEM;
}
if (src->idiag_meminfo) {
if (!(dst->idiag_meminfo = (struct idiagnl_meminfo *) nl_object_clone((struct nl_object *) src->idiag_meminfo)))
return -NLE_NOMEM;
}
if (src->idiag_vegasinfo) {
if (!(dst->idiag_vegasinfo = (struct idiagnl_vegasinfo *) nl_object_clone((struct nl_object *) src->idiag_vegasinfo)))
return -NLE_NOMEM;
}
return 0;
}