From ff9411f6d3f63e765bf29853b920605965a16794 Mon Sep 17 00:00:00 2001 From: Jan Synacek Date: Tue, 3 Jan 2017 21:34:36 +0100 Subject: [PATCH] shared: fix double free in unmask (#5005) Easily reproducible: 1) systemctl mask foo 2) systemctl unmask foo foo The problem here is that the *i that is put into todo[] is later freed in strv_uniq(), which is not directly visible from this patch. Somewhere further in the code, the string that *i pointed to is freed again. That happens only when multiple services with the same name/path are specified. (cherry picked from commit dc7dd61de610e9330abe7014860acfa733887d5e) --- src/shared/install.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/shared/install.c b/src/shared/install.c index 96fba6e25b..5f0eec3ccb 100644 --- a/src/shared/install.c +++ b/src/shared/install.c @@ -1861,7 +1861,7 @@ int unit_file_unmask( _cleanup_lookup_paths_free_ LookupPaths paths = {}; _cleanup_set_free_free_ Set *remove_symlinks_to = NULL; - _cleanup_free_ char **todo = NULL; + _cleanup_strv_free_ char **todo = NULL; size_t n_todo = 0, n_allocated = 0; const char *config_path; char **i; @@ -1899,7 +1899,7 @@ int unit_file_unmask( if (!GREEDY_REALLOC0(todo, n_allocated, n_todo + 2)) return -ENOMEM; - todo[n_todo++] = *i; + todo[n_todo++] = strdup(*i); } strv_uniq(todo); -- 2.9.3