In case there are no event handlers registered with the handle,
get_all_event_callbacks will count 0 elements, trying to malloc a buffer
of that size. POSIX says that this can result in either a null pointer,
or an unusable pointer.
Short-circuit get_all_event_callbacks to allocate nothing when there are
no events, making sure to use its results only when there were events.
---
ruby/ext/guestfs/handle.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/ruby/ext/guestfs/handle.c b/ruby/ext/guestfs/handle.c
index aa10825..b04192d 100644
--- a/ruby/ext/guestfs/handle.c
+++ b/ruby/ext/guestfs/handle.c
@@ -54,7 +54,7 @@ free_handle (void *gvp)
* the callbacks that we are about to invoke, resulting in
* a double-free. XXX
*/
- size_t len, i;
+ size_t len;
VALUE **roots = get_all_event_callbacks (g, &len);
/* Close the handle: this could invoke callbacks from the list
@@ -64,11 +64,14 @@ free_handle (void *gvp)
guestfs_close (g);
/* Now unregister the global roots. */
- for (i = 0; i < len; ++i) {
- rb_gc_unregister_address (roots[i]);
- free (roots[i]);
+ if (len > 0) {
+ size_t i;
+ for (i = 0; i < len; ++i) {
+ rb_gc_unregister_address (roots[i]);
+ free (roots[i]);
+ }
+ free (roots);
}
- free (roots);
}
}
@@ -384,6 +387,10 @@ get_all_event_callbacks (guestfs_h *g, size_t *len_rtn)
root = guestfs_next_private (g, &key);
}
+ /* No events, so no need to allocate anything. */
+ if (*len_rtn == 0)
+ return NULL;
+
/* Copy them into the return array. */
r = malloc (sizeof (VALUE *) * (*len_rtn));
if (r == NULL)
--
2.9.3