Re: [PATCH 1/1] libctf: Fix double free in ctf_link_add_cu_mapping.

[Alan Modra <amodra@gmail.com>]

On Wed, Dec 07, 2022 at 03:11:37PM +0100, Felix Willgerodt via Binutils wrote:
> This fixes a potential double free which can occur if we jump to
> oom_noerrno after the first free.
> 
> I am not very familiar with libctf, so any comments are welcome.
> I am wondering if the right solution wouldn't be to free both t and f before
> the "return 0".  But I didn't fully understand the code and saw that other
> users of ctf_dynhash_insert() also don't free the key manually.

No, they can't be freed if successfully inserted into the hash table,
but "t" should indeed be freed if already inserted.  I'm applying the
following fix.

	* ctf-link.c (ctf_link_add_cu_mapping): Set t NULL after free.

diff --git a/libctf/ctf-link.c b/libctf/ctf-link.c
index 702f2b4d5fe..902b4408cd6 100644
--- a/libctf/ctf-link.c
+++ b/libctf/ctf-link.c
@@ -431,7 +431,10 @@ ctf_link_add_cu_mapping (ctf_dict_t *fp, const char *from, const char *to)
 	}
     }
   else
-    free (t);
+    {
+      free (t);
+      t = NULL;
+    }
 
   if (ctf_dynhash_insert (one_out, f, NULL) < 0)
     {


-- 
Alan Modra
Australia Development Lab, IBM