Hi Kirill,
On Fri, Aug 14, 2026 at 04:10:02PM +0300, Kirill Furman wrote:
> Passing incorrect argments in parse_logger() which contains sample and
> some values, value of logger->lb.smp_rgs will equal to smp_rgs and then,
> if goto error: occurs we firstly free(smp_rgs) and after it
> free(logger->lb.smp_rgs) inside free_logger() function causes double-free.
> It has been reported in GH #3458
>
> Fix it by checking the value of logger->lb.smp_rgs inside error:
> statement in parse_logger(), if it equal to smp_rgs - just assign
> NULL to logger->lb.smp_rgs.
>
> This fix should be backported to versions 2.6 and upper.
> ---
> src/log.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/src/log.c b/src/log.c
> index c21c21926..08e72d397 100644
> --- a/src/log.c
> +++ b/src/log.c
> @@ -1966,6 +1966,8 @@ int parse_logger(char **args, struct list *loggers, int
> do_del, const char *file
>
> error:
> free(smp_rgs);
> + if (logger->lb.smp_rgs == smp_rgs)
> + logger->lb.smp_rgs = NULL;
> free_logger(logger);
> return 0;
Thanks! I slightly edited it because it introduced a potential NULL
deref :-)
src/log.c: In function 'parse_logger':
src/log.c:1969:16: warning: potential null pointer dereference
[-Wnull-dereference]
The reason being all "goto error" before and including this one:
logger = calloc(1, sizeof(*logger));
if (!logger) {
memprintf(err, "out of memory");
goto error;
}
So I changed it to that and now it's OK:
- if (logger->lb.smp_rgs == smp_rgs)
+ if (logger && logger->lb.smp_rgs == smp_rgs)
Thanks!
Willy
