Date: Tue, 24 Feb 2026 05:59:23 +0000 From: Kyle Evans <kevans@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 686280c0fdc4 - main - libjail: avoid a double-free in the MAC label bits Message-ID: <699d3e3b.3f49e.3106aad9@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=686280c0fdc4807676c3e8b896a1816ce62d4457 commit 686280c0fdc4807676c3e8b896a1816ce62d4457 Author: Kyle Evans <kevans@FreeBSD.org> AuthorDate: 2026-02-24 05:55:12 +0000 Commit: Kyle Evans <kevans@FreeBSD.org> CommitDate: 2026-02-24 05:58:45 +0000 libjail: avoid a double-free in the MAC label bits As written, we'll repeatedly jps_free() the first element, which is obviously bogus. Fix it to index appropriately. Fixes: db3b39f063d9f ("libjail: extend struct handlers [...]") --- lib/libjail/jail.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/libjail/jail.c b/lib/libjail/jail.c index baabeb4afed9..95ba336b62ce 100644 --- a/lib/libjail/jail.c +++ b/lib/libjail/jail.c @@ -978,7 +978,7 @@ jailparam_free(struct jailparam *jp, unsigned njp) for (j = 0; j < njp; j++) { free(jp[j].jp_name); if (!(jp[j].jp_flags & JP_RAWVALUE)) { - jps_free(jp); + jps_free(&jp[j]); free(jp[j].jp_value); } }home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?699d3e3b.3f49e.3106aad9>