diff options
| author | Ben Pfaff <blp@nicira.com> | 2013-01-24 12:27:53 -0800 |
|---|---|---|
| committer | Ben Pfaff <blp@nicira.com> | 2013-01-24 12:27:53 -0800 |
| commit | 0b6a64ccceedba7c2b542217ec07891e0ab3f885 (patch) | |
| tree | 809a0ede2b84dfbeb59f18521c19e914c49d01d6 /ovsdb | |
| parent | 40fa9417d0bf4a49f63cc28a2591e6098bd4cf00 (diff) | |
ovsdb: Fix double-free in ovsdb_jsonrpc_session_close().
ovsdb_session_destroy() was called twice but it should only be called once.
This double-free is unlikely to cause problems in practice because it only
triggers if there were ever more than two outstanding requests in the
session at a time (because the only data being freed is an hmap, which
does not allocate any heap memory unless the hmap has more than two
elements).
Signed-off-by: Ben Pfaff <blp@nicira.com>
Acked-by: Ethan Jackson <ethan@nicira.com>
Diffstat (limited to 'ovsdb')
| -rw-r--r-- | ovsdb/jsonrpc-server.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/ovsdb/jsonrpc-server.c b/ovsdb/jsonrpc-server.c index 1d0b0e31..6d07c45d 100644 --- a/ovsdb/jsonrpc-server.c +++ b/ovsdb/jsonrpc-server.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2009, 2010, 2011, 2012 Nicira, Inc. +/* Copyright (c) 2009, 2010, 2011, 2012, 2013 Nicira, Inc. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -386,7 +386,6 @@ ovsdb_jsonrpc_session_close(struct ovsdb_jsonrpc_session *s) ovsdb_jsonrpc_session_unlock_all(s); jsonrpc_session_close(s->js); list_remove(&s->node); - ovsdb_session_destroy(&s->up); s->remote->server->n_sessions--; ovsdb_session_destroy(&s->up); free(s); |