Passing incorrect argments in parse_logger() which contains sample and
some values, value of logger->lb.smp_rgs will equal to smp_rgs and then,
if goto error: occurs we firstly free(smp_rgs) and after it
free(logger->lb.smp_rgs) inside free_logger() function causes double-free.
It has been reported in GH #3458
Fix it by checking the value of logger->lb.smp_rgs inside error:
statement in parse_logger(), if it equal to smp_rgs - just assign
NULL to logger->lb.smp_rgs.
This fix should be backported to versions 2.6 and upper.
---
src/log.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/log.c b/src/log.c
index c21c21926..08e72d397 100644
--- a/src/log.c
+++ b/src/log.c
@@ -1966,6 +1966,8 @@ int parse_logger(char **args, struct list *loggers, int
do_del, const char *file
error:
free(smp_rgs);
+ if (logger->lb.smp_rgs == smp_rgs)
+ logger->lb.smp_rgs = NULL;
free_logger(logger);
return 0;
}
--
2.50.1 (Apple Git-155)
