File debugreiserfs-fix-use-after-free-while-closing-log of Package reiserfs

Overview Repositories Revisions Requests Users Attributes Meta

File debugreiserfs-fix-use-after-free-while-closing-log of Package reiserfs (Revision a2883a66f44e36f8824a582a6cf8dfb6)

Currently displaying revision a2883a66f44e36f8824a582a6cf8dfb6 , Show latest

From fe448aeac49e5eb7d388bbc8dc5c559b24a3d1b4 Mon Sep 17 00:00:00 2001
From: Jeff Mahoney <jeffm@suse.com>
Date: Wed, 6 Nov 2013 13:48:49 -0500
Subject: debugreiserfs: fix use after free while closing log
Git-repo: gitolite.kernel.org:/pub/scm/linux/kernel/git/jeffm/reiserfsprogs.git
Git-commit: fe448aeac49e5eb7d388bbc8dc5c559b24a3d1b4
References: bnc#849264

reiserfs_close(fs) frees fs and we were using it after freeing
to close the log.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
---
 debugreiserfs/debugreiserfs.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/debugreiserfs/debugreiserfs.c b/debugreiserfs/debugreiserfs.c
index edd89db..89bfece 100644
--- a/debugreiserfs/debugreiserfs.c
+++ b/debugreiserfs/debugreiserfs.c
@@ -686,6 +686,7 @@ int main(int argc, char *argv[])
 	char *file_name;
 	int error;
 	struct debugreiserfs_data *data;
+	FILE *log;
 
 	data = getmem(sizeof(struct debugreiserfs_data));
 	file_name = parse_options(data, argc, argv);
@@ -777,9 +778,9 @@ int main(int argc, char *argv[])
 		break;
 	}
 
+	log = data(fs)->log;
 	reiserfs_close(fs);
-	if (data(fs)->log) {
-		fclose(data(fs)->log);
-	}
+	if (log)
+		fclose(log);
 	return 0;
 }

Places

File debugreiserfs-fix-use-after-free-while-closing-log of Package reiserfs (Revision a2883a66f44e36f8824a582a6cf8dfb6)

Places