Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

Merge pull request #107 from Zedzap/master

Fix use-after-free in flashcache_destroy
  • Loading branch information...
commit 6423f40c367c1ee705e222210873ebebb3b7bd8d 2 parents 8b1e2cb + f5ca34e
@mohans mohans authored
Showing with 6 additions and 6 deletions.
  1. +6 −6 src/utils/flashcache_destroy.c
View
12 src/utils/flashcache_destroy.c
@@ -51,6 +51,7 @@ usage(char *pname)
}
char *pname;
+char *sb_buf;
char *buf;
main(int argc, char **argv)
@@ -84,16 +85,16 @@ main(int argc, char **argv)
exit(1);
}
lseek(cache_fd, 0, SEEK_SET);
- buf = (char *)malloc(512);
- if (!buf) {
+ sb_buf = (char *)malloc(512);
+ if (!sb_buf) {
fprintf(stderr, "Failed to allocate sector buffer\n");
exit(1);
}
- if (read(cache_fd, buf, 512) < 0) {
+ if (read(cache_fd, sb_buf, 512) < 0) {
fprintf(stderr, "Cannot read Flashcache superblock %s\n", ssd_devname);
exit(1);
}
- sb = (struct flash_superblock *)buf;
+ sb = (struct flash_superblock *)sb_buf;
if (!(sb->cache_sb_state == CACHE_MD_STATE_DIRTY ||
sb->cache_sb_state == CACHE_MD_STATE_CLEAN ||
sb->cache_sb_state == CACHE_MD_STATE_FASTCLEAN ||
@@ -113,7 +114,6 @@ main(int argc, char **argv)
lseek(cache_fd, md_block_bytes, SEEK_SET); /* lseek past the superblock to first MD slot */
md_slots_per_block = (md_block_bytes / (sizeof(struct flash_cacheblock)));
- free(buf);
buf = (char *)malloc(md_block_bytes);
if (!buf) {
fprintf(stderr, "Failed to allocate sector buffer\n");
@@ -154,7 +154,7 @@ main(int argc, char **argv)
pname, ssd_devname);
sb->cache_sb_state = 0;
lseek(cache_fd, 0, SEEK_SET);
- if (write(cache_fd, buf, 512) < 0) {
+ if (write(cache_fd, sb_buf, 512) < 0) {
fprintf(stderr, "Cannot write Flashcache superblock %s\n", ssd_devname);
exit(1);
}
Please sign in to comment.
Something went wrong with that request. Please try again.