rbd_snap_list_end() segfaults if rbd_snap_list() fails
in SnapIterator in rbd.pyx, rbd_snap_list_end() is called by SnapIterator.__dealloc__(). and rbd_snap_list_end() freessnaps->name if it is not nullptr. but there is chance that snaps->name is never initialized after snaps is allocated by SnapIterator.__init__, in that case, we will free() a wild pointer.
- Status changed from In Progress to Fix Under Review
Updated by Jason Dillaman about 4 years ago
- Status changed from Fix Under Review to Pending Backport
- Copied to Backport #37535: luminous: rbd_snap_list_end() segfaults if rbd_snap_list() fails added
- Copied to Backport #37536: mimic: rbd_snap_list_end() segfaults if rbd_snap_list() fails added
- Status changed from Pending Backport to Resolved
While running with --resolve-parent, the script "backport-create-issue" noticed that all backports of this issue are in status "Resolved" or "Rejected".
Also available in: Atom