summaryrefslogtreecommitdiffstats
path: root/src/vlib
diff options
context:
space:
mode:
authorBenoît Ganne <bganne@cisco.com>2019-07-08 14:39:02 +0200
committerOle Trøan <otroan@employees.org>2019-07-22 10:11:32 +0000
commitf7c30df4bbeace3917164b249724d8cf0d8a6fec (patch)
treed13a8f21909d1544c15b73c2e311a68430be3d0f /src/vlib
parent1f50bf8fc57ebf78f9056185a342493be460a847 (diff)
stats: fix use-after-free hash key string
Hash keys are not copied by the hash infrastructure, instead the pointer is used directly. stat_segment_register_gauge() does not allocate a private object for the key, causing issues when it is freed or reused. Allocate a private object on insertion into the hashtable instead. Type: fix Fixes: 92e3082199d10add866894e86a9762d79a3536c4 Change-Id: Ifb6addfcaec81bdb7ea3512050ce55f06ef09a4c Signed-off-by: Benoît Ganne <bganne@cisco.com>
Diffstat (limited to 'src/vlib')
-rw-r--r--src/vlib/error.c9
1 files changed, 6 insertions, 3 deletions
diff --git a/src/vlib/error.c b/src/vlib/error.c
index ef506635ad9..58e13431d9f 100644
--- a/src/vlib/error.c
+++ b/src/vlib/error.c
@@ -160,15 +160,18 @@ vlib_register_errors (vlib_main_t * vm,
/* Register counter indices in the stat segment directory */
{
int i;
- u8 *error_name;
+ u8 *error_name = 0;
for (i = 0; i < n_errors; i++)
{
- error_name = format (0, "/err/%v/%s%c", n->name, error_strings[i], 0);
- /* Note: error_name consumed by the following call */
+ vec_reset_length (error_name);
+ error_name =
+ format (error_name, "/err/%v/%s%c", n->name, error_strings[i], 0);
vlib_stats_register_error_index (oldheap, error_name, em->counters,
n->error_heap_index + i);
}
+
+ vec_free (error_name);
}
/* (re)register the em->counters base address, switch back to main heap */