Skip to content

Commit e8dd593

Browse files
author
zhuwei
committed
examples/librados: fix memory pointed to by 'rs' is freed twice.
If striper_create() fails and delete rs; is called, and then read_file() also fails and calls delete rs; again, it will result in a double free, which may cause the program to crash or exhibit undefined behavior. Signed-off-by: Zhu Wei <[email protected]>
1 parent 5aeaa10 commit e8dd593

File tree

1 file changed

+13
-3
lines changed

1 file changed

+13
-3
lines changed

examples/librados/hello_radosstriper.cc

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ int main(int argc, char* argv[])
6060
{
6161
std::cerr << "Couldn't Create RadosStriper"<< ret << std::endl;
6262
delete rs;
63+
rs = nullptr;
6364
}
6465
uint64_t alignment = 0;
6566
ret = io_ctx.pool_required_alignment2(&alignment);
@@ -68,7 +69,10 @@ int main(int argc, char* argv[])
6869
std::cerr << "IO_CTX didn't give alignment "<< ret
6970
<< "\n Is this an erasure coded pool? "<< std::endl;
7071

71-
delete rs;
72+
if (rs) {
73+
delete rs;
74+
rs = nullptr;
75+
}
7276
io_ctx.close();
7377
cluster.shutdown();
7478
return EXIT_FAILURE;
@@ -86,7 +90,10 @@ int main(int argc, char* argv[])
8690
if(err != "no_err")
8791
{
8892
std::cout << "Error reading file into bufferlist: "<< err << std::endl;
89-
delete rs;
93+
if (rs) {
94+
delete rs;
95+
rs = nullptr;
96+
}
9097
io_ctx.close();
9198
cluster.shutdown();
9299
return EXIT_FAILURE;
@@ -96,7 +103,10 @@ int main(int argc, char* argv[])
96103
rs->write_full(obj_name,bl);
97104
std::cout << "done with: " << fname << std::endl;
98105

99-
delete rs;
106+
if (rs) {
107+
delete rs;
108+
rs = nullptr;
109+
}
100110
io_ctx.close();
101111
cluster.shutdown();
102112
}

0 commit comments

Comments
 (0)