Opened 2 years ago

Closed 2 years ago

#23329 closed defect (fixed)

sandbox: Double free when initializing the HSv3 config

Reported by: dgoulet Owned by: dgoulet
Priority: Medium Milestone: Tor: 0.3.2.x-final
Component: Core Tor/Tor Version:
Severity: Normal Keywords: tor-hs, tor-sandbox
Cc: Actual Points:
Parent ID: Points: 0.1
Reviewer: Sponsor:

Description

In main.c:

       /* steals references */
       sandbox_cfg_allow_open_filename(&cfg, file_name);
       sandbox_cfg_allow_open_filename(&cfg, tmp_name);
       tor_free(file_name);

... freeing after stealing a reference is really not good :).

Introduced in 5d2506d70cd which was never released.

Child Tickets

Change History (2)

comment:1 Changed 2 years ago by dgoulet

Status: assignedmerge_ready

Branch: bug23329_032_01

comment:2 Changed 2 years ago by nickm

Resolution: fixed
Status: merge_readyclosed

merged!

Note: See TracTickets for help on using tickets.