fix use after free bug in the trigger handling code

[project/procd.git] / service.c

diff --git a/service.c b/service.c
index 4189e2d..158e096 100644 (file)
--- a/service.c
+++ b/service.c
@@ -55,7 +55,7 @@ service_instance_update(struct vlist_tree *tree, struct vlist_node *node_new,
                instance_free(in_n);
        } else if (in_o) {
                DEBUG(1, "Free instance %s::%s\n", in_o->srv->name, in_o->name);
-               instance_stop(in_o, false);
+               instance_stop(in_o);
                instance_free(in_o);
        } else if (in_n) {
                DEBUG(1, "Create instance %s::%s\n", in_n->srv->name, in_n->name);
@@ -101,11 +101,17 @@ service_update(struct service *s, struct blob_attr *config, struct blob_attr **t
        struct blob_attr *cur;
        int rem;
 
-       if (s->trigger)
+       if (s->trigger) {
                trigger_del(s);
+               free(s->trigger);
+               s->trigger = NULL;
+       }
 
        if (tb[SERVICE_SET_TRIGGER] && blobmsg_data_len(tb[SERVICE_SET_TRIGGER])) {
-               s->trigger = tb[SERVICE_SET_TRIGGER];
+               s->trigger = malloc(blob_len(tb[SERVICE_SET_TRIGGER]));
+               if (!s->trigger)
+                       return -1;
+               memcpy(s->trigger, tb[SERVICE_SET_TRIGGER], blob_len(tb[SERVICE_SET_TRIGGER]));
                trigger_add(s->trigger, s);
        }
 
@@ -128,6 +134,8 @@ service_delete(struct service *s)
        vlist_flush_all(&s->instances);
        avl_delete(&services, &s->avl);
        trigger_del(s);
+       s->trigger = NULL;
+       free(s->trigger);
        free(s->config);
        free(s);
 }
@@ -220,16 +228,19 @@ service_dump(struct service *s, int verbose)
        struct service_instance *in;
        void *c, *i;
 
-       if (avl_is_empty(&s->instances.avl))
+       c = blobmsg_open_table(&b, s->name);
+
+       if (avl_is_empty(&s->instances.avl)) {
+               blobmsg_close_table(&b, c);
                return;
+       }
 
-       c = blobmsg_open_table(&b, s->name);
-       if (verbose && s->trigger)
-               blobmsg_add_blob(&b, s->trigger);
        i = blobmsg_open_table(&b, "instances");
        vlist_for_each_element(&s->instances, in, node)
                instance_dump(&b, in, verbose);
        blobmsg_close_table(&b, i);
+       if (verbose && s->trigger)
+               blobmsg_add_blob(&b, s->trigger);
        blobmsg_close_table(&b, c);
 }