Issue 6485 - Fix double free in USN cleanup task #6486
Conversation
There was a problem hiding this comment.
Currently the bind_dn refers to the SLAPI_REQUESTOR_DN that was in the pblock when the task was spawn. Indeed it is freed when pblock_done and there is a double free in task_destructor. IMHO there is a risk of 'user after free' if bind_dn after it has been free by pblock_done.
If I am not missing something, I would prefer that the bind_dn is duplicated when creating the task data (usn_cleanup_add) and free during task_desctructor.
Description: ASAN report shows double free of bind dn in the USN cleanup task data. The bind dn was passed as a reference so it should never have to be freed by the cleanup task. Relates: 389ds#6485 Reviewed by: tbordaz(Thanks!)
That crossed my mind, but I'm just always trying to avoid malloc/freeing when possible. Anyway you are right. There is a risk, although the window is small, it's still there. Nice catch! Fixed |
Description:
ASAN report shows double free of bind dn in the USN cleanup task data. The bind dn was passed as a reference so it should never have to be freed by the cleanup task.
Relates: #6485