瀏覽代碼

Bug 630097 - (cov#15464) NULL dereference in repl code

If the attr parameter that is passed to my_ber_scanf_attr() is
NULL, we jump to the loser label where we clean up memory we may
have allocated.  We dereference attr without first checking if it
is NULL in this clean-up code.  We need to check if attr is NULL
before dereferencing it.
Nathan Kinder 15 年之前
父節點
當前提交
09653dc9d5
共有 1 個文件被更改,包括 1 次插入1 次删除
  1. 1 1
      ldap/servers/plugins/replication/repl5_total.c

+ 1 - 1
ldap/servers/plugins/replication/repl5_total.c

@@ -689,7 +689,7 @@ my_ber_scanf_attr (BerElement *ber, Slapi_Attr **attr, PRBool *deleted)
 
     return 0;
 loser:
-    if (*attr)
+    if (attr && *attr)
         slapi_attr_free (attr);
     if (value)
         slapi_value_free (&value);