How to reproduce: 1. Extract test images from test/data/ldm-data.tar.xz 2. losetup --show -f test/data/ldm-2003r2-simple-1.img Let's assume image file was associated with /dev/loop0 3. ldmtool -d /dev/loop0 create all Result: One LDM volume which contains all required components on the associated loop device will be mapped but application crashes on further attempt to do the same for incomplete volumes with error "Error in `ldmtool': free(): invalid pointer: 0x.......". Reason: _dm_create_spanned and _dm_create_striped functions define static local variable "static GString *name" which is at the same time a function return value. So variable remains its value in between of function calls. "name" pointer will be initialized if spanned/stripped volume is successfully created. It is passed up the call stack and is freed in _ldm_vol_action function. Next call to the same function with an attempt to create the volume which misses some partition will fail. "goto out" statement is executed and pointer to an already freed block of memory will be returned. --- src/ldm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/ldm.c b/src/ldm.c index 19a0663..e112ae0 100644 --- a/src/ldm.c +++ b/src/ldm.c @@ -2615,7 +2615,7 @@ _dm_create_part(const LDMPartitionPrivate * const part, uint32_t cookie, static GString * _dm_create_spanned(const LDMVolumePrivate * const vol, GError ** const err) { - static GString *name = NULL; + GString *name = NULL; guint i = 0; struct dm_target *targets = g_malloc(sizeof(*targets) * vol->parts->len); @@ -2682,7 +2682,7 @@ out: static GString * _dm_create_striped(const LDMVolumePrivate * const vol, GError ** const err) { - static GString *name = NULL; + GString *name = NULL; struct dm_target target; target.start = 0; @@ -2961,7 +2961,7 @@ ldm_volume_dm_create(const LDMVolume * const o, GString **created, return TRUE; } dm_tree_free(tree); tree = NULL; - g_string_free(name, TRUE); + g_string_free(name, TRUE); name = NULL; switch (vol->type) { case LDM_VOLUME_TYPE_SIMPLE: -- 2.17.0