Quoting Wolfgang Bumiller (w.bumil...@proxmox.com): > --- > src/lxc/start.c | 20 ++++++++++++++++++-- > 1 file changed, 18 insertions(+), 2 deletions(-) > > diff --git a/src/lxc/start.c b/src/lxc/start.c > index a1eb961..7a909de 100644 > --- a/src/lxc/start.c > +++ b/src/lxc/start.c > @@ -486,15 +486,31 @@ out_free: > > void lxc_fini(const char *name, struct lxc_handler *handler) > { > - int i; > + int i, rc; > + pid_t self = getpid(); > + char **namespaces = (char**)malloc((LXC_NS_MAX+1) * sizeof(char*)); > + size_t namespace_count = 0; > > /* The STOPPING state is there for future cleanup code > * which can take awhile > */ > lxc_set_state(name, handler, STOPPING); > > - if (run_lxc_hooks(name, "stop", handler->conf, handler->lxcpath, NULL)) > + for (i = 0; i < LXC_NS_MAX; i++) { > + if (handler->nsfd[i] != -1) { > + rc = asprintf(&namespaces[namespace_count++], > "%s:/proc/%d/fd/%d", > + ns_info[i].proc_name, self, > handler->nsfd[i]);
If asprintf fails, the contents of the first arg are undefined. So iiuc the error loop below, on error, will try to first free an undefined value. So I think the if (rc == -1) block needs to decrement namespace_count. > + if (rc == -1) { > + SYSERROR("failed to allocate memory"); > + break; > + } > + } > + } > + namespaces[namespace_count] = NULL; > + if (run_lxc_hooks(name, "stop", handler->conf, handler->lxcpath, > namespaces)) > ERROR("failed to run stop hooks for container '%s'.", name); > + while (namespace_count--) > + free(namespaces[namespace_count]); > for (i = 0; i < LXC_NS_MAX; i++) { > if (handler->nsfd[i] != -1) { > close(handler->nsfd[i]); > -- > 2.1.4 > > > _______________________________________________ > lxc-devel mailing list > lxc-devel@lists.linuxcontainers.org > http://lists.linuxcontainers.org/listinfo/lxc-devel _______________________________________________ lxc-devel mailing list lxc-devel@lists.linuxcontainers.org http://lists.linuxcontainers.org/listinfo/lxc-devel