You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficserver.apache.org by so...@apache.org on 2014/07/16 05:12:47 UTC
[06/14] git commit: TS-1475: Coverity 1021656 - fix use after free.
TS-1475: Coverity 1021656 - fix use after free.
Project: http://git-wip-us.apache.org/repos/asf/trafficserver/repo
Commit: http://git-wip-us.apache.org/repos/asf/trafficserver/commit/efc8f0af
Tree: http://git-wip-us.apache.org/repos/asf/trafficserver/tree/efc8f0af
Diff: http://git-wip-us.apache.org/repos/asf/trafficserver/diff/efc8f0af
Branch: refs/heads/master
Commit: efc8f0af9dc3b09dbd1588fa8715870f5e22dc0c
Parents: d44fb57
Author: Jeff Elsloo <je...@cable.comcast.com>
Authored: Tue Jul 15 14:18:00 2014 -0600
Committer: Phil Sorber <so...@apache.org>
Committed: Tue Jul 15 21:11:38 2014 -0600
----------------------------------------------------------------------
iocore/cluster/ClusterProcessor.cc | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/trafficserver/blob/efc8f0af/iocore/cluster/ClusterProcessor.cc
----------------------------------------------------------------------
diff --git a/iocore/cluster/ClusterProcessor.cc b/iocore/cluster/ClusterProcessor.cc
index eb73de1..a37d0a3 100644
--- a/iocore/cluster/ClusterProcessor.cc
+++ b/iocore/cluster/ClusterProcessor.cc
@@ -69,9 +69,6 @@ ClusterProcessor::internal_invoke_remote(ClusterHandler *ch, int cluster_fn,
if (!ch || (!malloced && !((unsigned int) cluster_fn < (uint32_t) SIZE_clusterFunction))) {
// Invalid message or node is down, free message data
- if (malloced) {
- ats_free(data);
- }
if (cmsg) {
invoke_remote_data_args *args = (invoke_remote_data_args *)
(((OutgoingControl *) cmsg)->data + sizeof(int32_t));
@@ -84,6 +81,9 @@ ClusterProcessor::internal_invoke_remote(ClusterHandler *ch, int cluster_fn,
c = *((OutgoingControl **) ((char *) data - sizeof(OutgoingControl *)));
c->freeall();
}
+ if (malloced) {
+ ats_free(data);
+ }
return -1;
}