From eb18e7b7825e8320bb4d6269690ef8c3f5461d2b Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 12 Dec 2022 14:16:09 +0900 Subject: [PATCH] sd-device: fix double-free If an attribute is read but the value is not used (i.e. ret_value is NULL), then sd_device_get_sysattr_value() mistakenly frees the read data even though it is cached internally. Fixes a bug introduced by acfc2a1d15560084e077ffb3be472cd117e9020a. Fixes #25702. --- src/libsystemd/sd-device/sd-device.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/libsystemd/sd-device/sd-device.c b/src/libsystemd/sd-device/sd-device.c index 55a0ee730e..9c4743f055 100644 --- a/src/libsystemd/sd-device/sd-device.c +++ b/src/libsystemd/sd-device/sd-device.c @@ -2332,9 +2332,14 @@ _public_ int sd_device_get_sysattr_value(sd_device *device, const char *sysattr, sysattr, value, ret_value ? "" : ", ignoring"); if (ret_value) return r; - } else if (ret_value) - *ret_value = TAKE_PTR(value); + return 0; + } + + if (ret_value) + *ret_value = value; + + TAKE_PTR(value); return 0; } -- 2.25.1