Skip to content

Fix double-free via free_rr_data nullifying local variable instead of caller's pointer#156

Merged
versat merged 2 commits into
masterfrom
copilot/fix-double-free-via-free-rr-data
Jun 24, 2026
Merged

Fix double-free via free_rr_data nullifying local variable instead of caller's pointer#156
versat merged 2 commits into
masterfrom
copilot/fix-double-free-via-free-rr-data

Conversation

Copilot AI commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

free_rr_data nullified its local data copy instead of *pdata, leaving the caller's pointer dangling after the free. In loops across direct.c and forward.c, freed data[0]/data[1] pointers could be passed to reset_rr_data or freed again, triggering double-free/use-after-free.

Change

  • utils.cfree_rr_data: replace data = NULL with *pdata = NULL so the caller's pointer is zeroed after the underlying struct is freed.
// Before
free(data);
data = NULL;   // only nullifies the local copy — caller's pointer still dangling

// After
free(data);
*pdata = NULL; // nullifies the caller's pointer

Copilot AI changed the title [WIP] Fix double free via free_rr_data in utils.c Fix double-free via free_rr_data nullifying local variable instead of caller's pointer Jun 24, 2026
Copilot AI requested a review from versat June 24, 2026 07:50
@sonarqubecloud

Copy link
Copy Markdown

@versat versat marked this pull request as ready for review June 24, 2026 09:56
@versat versat merged commit 2f0283a into master Jun 24, 2026
12 of 13 checks passed
@versat versat deleted the copilot/fix-double-free-via-free-rr-data branch June 24, 2026 09:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants