fix use after free bug in the trigger handling code

[project/procd.git] / instance.c

diff --git a/instance.c b/instance.c
index e263b84..c25c859 100644 (file)
--- a/instance.c
+++ b/instance.c
@@ -317,11 +317,15 @@ instance_config_parse(struct service_instance *in)
                return false;
 
        in->command = cur;
-       in->trigger = tb[INSTANCE_ATTR_TRIGGER];
 
-       if (in->trigger) {
+       if (tb[INSTANCE_ATTR_TRIGGER]) {
+               in->trigger = malloc(blob_len(tb[INSTANCE_ATTR_TRIGGER]));
+               if (!in->trigger)
+                       return -1;
+               memcpy(in->trigger, tb[INSTANCE_ATTR_TRIGGER], blob_len(tb[INSTANCE_ATTR_TRIGGER]));
                trigger_add(in->trigger, in);
        }
+
        if ((cur = tb[INSTANCE_ATTR_NICE])) {
                in->nice = (int8_t) blobmsg_get_u32(cur);
                if (in->nice < -20 || in->nice > 20)
@@ -395,6 +399,7 @@ instance_free(struct service_instance *in)
        uloop_process_delete(&in->proc);
        uloop_timeout_cancel(&in->timeout);
        trigger_del(in);
+       free(in->trigger);
        instance_config_cleanup(in);
        free(in->config);
        free(in);
@@ -422,6 +427,7 @@ instance_init(struct service_instance *in, struct service *s, struct blob_attr *
 void instance_dump(struct blob_buf *b, struct service_instance *in, int verbose)
 {
        void *i;
+       struct pid_info pi;
 
        i = blobmsg_open_table(b, in->name);
        blobmsg_add_u8(b, "running", in->proc.pending);
@@ -430,5 +436,18 @@ void instance_dump(struct blob_buf *b, struct service_instance *in, int verbose)
        blobmsg_add_blob(b, in->command);
        if (verbose && in->trigger)
                blobmsg_add_blob(b, in->trigger);
+       if (!measure_process(in->proc.pid, &pi)) {
+               struct timespec tp;
+               long uptime;
+
+               clock_gettime(CLOCK_MONOTONIC, &tp);
+               uptime = tp.tv_sec - in->start.tv_sec;
+
+               blobmsg_add_u8(b, "ppid", pi.ppid);
+               blobmsg_add_u16(b, "uid", pi.uid);
+               blobmsg_add_u32(b, "fdcount", pi.fdcount);
+               blobmsg_add_u32(b, "vmsize", pi.vmsize);
+               blobmsg_add_u32(b, "uptime", uptime);
+       }
        blobmsg_close_table(b, i);
 }