From e7fc91d7d5fcd98a9784901b7befe6d0e6dda5d7 Mon Sep 17 00:00:00 2001 From: Yifeng Sun Date: Fri, 5 Oct 2018 15:16:50 -0700 Subject: [PATCH] extend-table: Fix a bug that iterates wrong table This seems to be a copy and paste bug that iterates and frees the wrong table. This commit fixes that. Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10730 Co-authored-by: Ben Pfaff Signed-off-by: Yifeng Sun Signed-off-by: Ben Pfaff --- ovn/lib/extend-table.c | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-) diff --git a/ovn/lib/extend-table.c b/ovn/lib/extend-table.c index 511d1a84b0c..56c784f797f 100644 --- a/ovn/lib/extend-table.c +++ b/ovn/lib/extend-table.c @@ -33,26 +33,25 @@ ovn_extend_table_init(struct ovn_extend_table *table) hmap_init(&table->existing); } +static void +ovn_extend_table_info_destroy(struct hmap *target) +{ + struct ovn_extend_table_info *e, *next; + HMAP_FOR_EACH_SAFE (e, next, hmap_node, target) { + hmap_remove(target, &e->hmap_node); + free(e->name); + free(e); + } + hmap_destroy(target); +} + void ovn_extend_table_destroy(struct ovn_extend_table *table) { bitmap_free(table->table_ids); - struct ovn_extend_table_info *desired, *d_next; - HMAP_FOR_EACH_SAFE (desired, d_next, hmap_node, &table->existing) { - hmap_remove(&table->existing, &desired->hmap_node); - free(desired->name); - free(desired); - } - hmap_destroy(&table->desired); - - struct ovn_extend_table_info *existing, *e_next; - HMAP_FOR_EACH_SAFE (existing, e_next, hmap_node, &table->existing) { - hmap_remove(&table->existing, &existing->hmap_node); - free(existing->name); - free(existing); - } - hmap_destroy(&table->existing); + ovn_extend_table_info_destroy(&table->desired); + ovn_extend_table_info_destroy(&table->existing); } /* Finds and returns a group_info in 'existing' whose key is identical