gian/ceph-mirror
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2026-08-02 07:03:18 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

examples/librados: fix memory pointed to by 'rs' is freed twice.

Browse Source 
If striper_create() fails and delete rs; is called, and then read_file() also fails and calls delete rs; again, it will result in a double free, which may cause the program to crash or exhibit undefined behavior.

Signed-off-by: Zhu Wei <zhuwei_yewu@cmss.chinamobile.com>
This commit is contained in:
zhuwei 2025-06-30 10:59:23 +08:00
parent 5aeaa104d8
commit e8dd59354c
1 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
examples/librados/hello_radosstriper.cc
View File

@ -60,6 +60,7 @@ int main(int argc, char* argv[])
{
std::cerr << "Couldn't Create RadosStriper"<< ret << std::endl;
delete rs;
rs = nullptr;
}
uint64_t alignment = 0;
ret = io_ctx.pool_required_alignment2(&alignment);
@ -68,7 +69,10 @@ int main(int argc, char* argv[])
std::cerr << "IO_CTX didn't give alignment "<< ret
<< "\n Is this an erasure coded pool? "<< std::endl;
delete rs;
if (rs) {
delete rs;
rs = nullptr;
}
io_ctx.close();
cluster.shutdown();
return EXIT_FAILURE;
@ -86,7 +90,10 @@ int main(int argc, char* argv[])
if(err != "no_err")
{
std::cout << "Error reading file into bufferlist: "<< err << std::endl;
delete rs;
if (rs) {
delete rs;
rs = nullptr;
}
io_ctx.close();
cluster.shutdown();
return EXIT_FAILURE;
@ -96,7 +103,10 @@ int main(int argc, char* argv[])
rs->write_full(obj_name,bl);
std::cout << "done with: " << fname << std::endl;
delete rs;
if (rs) {
delete rs;
rs = nullptr;
}
io_ctx.close();
cluster.shutdown();
}