Quoting Wolfgang Bumiller (w.bumil...@proxmox.com):
> ---
> src/lxc/start.c | 20 ++++++++++++++++++--
> 1 file changed, 18 insertions(+), 2 deletions(-)
>
> diff --git a/src/lxc/start.c b/src/lxc/start.c
> index a1eb961..7a909de 100644
> --- a/src/lxc/start.c
> +++ b/src/lxc/start.c
> @@ -486,15 +486,31 @@ out_free:
>
> void lxc_fini(const char *name, struct lxc_handler *handler)
> {
> - int i;
> + int i, rc;
> + pid_t self = getpid();
> + char **namespaces = (char**)malloc((LXC_NS_MAX+1) * sizeof(char*));
> + size_t namespace_count = 0;
>
> /* The STOPPING state is there for future cleanup code
> * which can take awhile
> */
> lxc_set_state(name, handler, STOPPING);
>
> - if (run_lxc_hooks(name, "stop", handler->conf, handler->lxcpath, NULL))
> + for (i = 0; i < LXC_NS_MAX; i++) {
> + if (handler->nsfd[i] != -1) {
> + rc = asprintf(&namespaces[namespace_count++],
> "%s:/proc/%d/fd/%d",
> + ns_info[i].proc_name, self,
> handler->nsfd[i]);
If asprintf fails, the contents of the first arg are undefined. So iiuc
the error loop below, on error, will try to first free an undefined
value. So I think the if (rc == -1) block needs to decrement namespace_count.
> + if (rc == -1) {
> + SYSERROR("failed to allocate memory");
> + break;
> + }
> + }
> + }
> + namespaces[namespace_count] = NULL;
> + if (run_lxc_hooks(name, "stop", handler->conf, handler->lxcpath,
> namespaces))
> ERROR("failed to run stop hooks for container '%s'.", name);
> + while (namespace_count--)
> + free(namespaces[namespace_count]);
> for (i = 0; i < LXC_NS_MAX; i++) {
> if (handler->nsfd[i] != -1) {
> close(handler->nsfd[i]);
> --
> 2.1.4
>
>
> _______________________________________________
> lxc-devel mailing list
> lxc-devel@lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel
_______________________________________________
lxc-devel mailing list
lxc-devel@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
