BUG/MINOR: log: fix double-free error when error in parse_loger occurs

Passing incorrect argments in parse_logger() which contains sample and
some values, value of logger->lb.smp_rgs will equal to smp_rgs and then,
if goto error: occurs we firstly free(smp_rgs) and after it
free(logger->lb.smp_rgs) inside free_logger() function causes double-free.
It has been reported in GH #3458

Fix it by checking the value of logger->lb.smp_rgs inside error:
statement in parse_logger(), if it equal to smp_rgs - just assign
NULL to logger->lb.smp_rgs.

This fix should be backported to versions 2.6 and upper.

diff --git a/src/log.c b/src/log.c
index c21c2192664295b619a1eba98985e371f2ea93ef..240ff2eec9869549c9afa80f557ba7b845a14a62 100644 (file)
--- a/src/log.c
+++ b/src/log.c
@@ -1966,6 +1966,8 @@ int parse_logger(char **args, struct list *loggers, int do_del, const char *file
 
   error:
        free(smp_rgs);
+       if (logger && logger->lb.smp_rgs == smp_rgs)
+               logger->lb.smp_rgs = NULL;
        free_logger(logger);
        return 0;
 }