Skip to content

Commit

Permalink
src/bundle: fix freeing of GPtrArray in casync_make_arch()
Browse files Browse the repository at this point in the history
This fixes both a memory leakage and a prevented double-free.

The 'iargs' pointer array is allocated using an auto pointer and a free
function. This works quite well until manually calling
g_ptr_array_free(). This correctly frees the pointer array structure and
leaves the memory pointed at untouched.

BUT, since 'iargs' itself is not NULL after this, the auto pointer
cleanup will later attempt to free the GPtrArray a second time and
causes an assertion error:

| g_atomic_ref_count_dec: assertion 'old_value > 0' failed

This can be fixed by simply accessing the pointer array data (->pdata)
without manual freeing.

Fixes rauc#1461

Reported-by: Matteo Carnelos <[email protected]>
Signed-off-by: Enrico Joerns <[email protected]>
  • Loading branch information
ejoerns committed Jul 18, 2024
1 parent 0299d72 commit d841abd
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/bundle.c
Original file line number Diff line number Diff line change
Expand Up @@ -259,7 +259,7 @@ static gboolean casync_make_arch(const gchar *idxpath, const gchar *contentpath,
g_ptr_array_add(args, g_strdup("fakeroot"));
g_ptr_array_add(args, g_strdup("sh"));
g_ptr_array_add(args, g_strdup("-c"));
g_ptr_array_add(args, g_strjoinv(" ", (gchar**) g_ptr_array_free(iargs, FALSE)));
g_ptr_array_add(args, g_strjoinv(" ", (gchar**) iargs->pdata));
g_ptr_array_add(args, NULL);

res = r_subprocess_runv(args, G_SUBPROCESS_FLAGS_STDOUT_SILENCE, &ierror);
Expand Down

0 comments on commit d841abd

Please sign in to comment.