From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:37498) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XqEdJ-0004LU-Eq for qemu-devel@nongnu.org; Mon, 17 Nov 2014 00:13:54 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XqEdB-0007h8-Pn for qemu-devel@nongnu.org; Mon, 17 Nov 2014 00:13:49 -0500 Message-ID: <546983F3.9010707@huawei.com> Date: Mon, 17 Nov 2014 13:13:23 +0800 From: zhanghailiang MIME-Version: 1.0 References: <1415929163-12184-1-git-send-email-zhang.zhanghailiang@huawei.com> <5465C130.1090401@redhat.com> In-Reply-To: <5465C130.1090401@redhat.com> Content-Type: text/plain; charset="windows-1252"; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] l2tpv3: fix possible double free List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Paolo Bonzini , qemu-trivial@nongnu.org Cc: qemu-devel@nongnu.org, stefanha@redhat.com, peter.huangpeng@huawei.com On 2014/11/14 16:45, Paolo Bonzini wrote: > > > On 14/11/2014 02:39, zhanghailiang wrote: >> freeaddrinfo(result) does not assign result = NULL, after frees it. >> There will be a double free when it goes error case. >> It is reported by covertiy. >> >> Signed-off-by: zhanghailiang >> --- >> net/l2tpv3.c | 1 + >> 1 file changed, 1 insertion(+) >> >> diff --git a/net/l2tpv3.c b/net/l2tpv3.c >> index 528d95b..f9e0c98 100644 >> --- a/net/l2tpv3.c >> +++ b/net/l2tpv3.c >> @@ -661,6 +661,7 @@ int net_init_l2tpv3(const NetClientOptions *opts, >> fd = -errno; >> error_report("l2tpv3_open : socket creation failed, errno = %d", -fd); >> freeaddrinfo(result); >> + result = NULL; > > You can just remove the call to freeaddrinfo(). I made the change and > applied the patch. > This is a better choice ;) Thanks. >> goto outerr; >> } >> if (bind(fd, (struct sockaddr *) result->ai_addr, result->ai_addrlen)) { >> > >