diff options
| author | Krishnan Parthasarathi <kp@gluster.com> | 2011-06-07 05:50:55 +0000 |
|---|---|---|
| committer | Anand Avati <avati@gluster.com> | 2011-06-08 11:18:16 -0700 |
| commit | 53b24b46c6e265f0d30e46ad635d09dbddaade3b (patch) | |
| tree | 0125dab37cf4485d4bb8cdc90e310e397bab182c /xlators/cluster/afr/src/afr-self-heal-data.c | |
| parent | a48fa5a64bdc1eb25977629d733314e133c7459d (diff) | |
pump: cleanup potential dict related memory corruption.
Signed-off-by: Krishnan Parthasarathi <kp@gluster.com>
Signed-off-by: Anand Avati <avati@gluster.com>
BUG: 2489 (GlusterFS crashing with replace-brick)
URL: http://bugs.gluster.com/cgi-bin/bugzilla3/show_bug.cgi?id=2489
Diffstat (limited to 'xlators/cluster/afr/src/afr-self-heal-data.c')
| -rw-r--r-- | xlators/cluster/afr/src/afr-self-heal-data.c | 32 |
1 files changed, 24 insertions, 8 deletions
diff --git a/xlators/cluster/afr/src/afr-self-heal-data.c b/xlators/cluster/afr/src/afr-self-heal-data.c index 13aa054dc..3791f21c1 100644 --- a/xlators/cluster/afr/src/afr-self-heal-data.c +++ b/xlators/cluster/afr/src/afr-self-heal-data.c @@ -844,7 +844,7 @@ afr_sh_data_fxattrop (call_frame_t *frame, xlator_t *this) afr_local_t *local = NULL; afr_private_t *priv = NULL; dict_t *xattr_req = NULL; - int32_t zero_pending[3] = {0,}; + int32_t *zero_pending = NULL; int call_count = 0; int i = 0; int ret = 0; @@ -859,13 +859,23 @@ afr_sh_data_fxattrop (call_frame_t *frame, xlator_t *this) local->call_count = call_count; xattr_req = dict_new(); - if (xattr_req) { - for (i = 0; i < priv->child_count; i++) { - ret = dict_set_static_bin (xattr_req, priv->pending_key[i], - zero_pending, 3 * sizeof(int32_t)); - if (ret < 0) - gf_log (this->name, GF_LOG_WARNING, - "Unable to set dict value"); + if (!xattr_req) { + gf_log (this->name, GF_LOG_ERROR, "Out of memory"); + goto out; + } + + for (i = 0; i < priv->child_count; i++) { + zero_pending = GF_CALLOC (3, sizeof (int32_t), gf_common_mt_int32_t); + if (!zero_pending) { + gf_log (this->name, GF_LOG_ERROR, "Out of memory"); + goto out; + } + ret = dict_set_dynptr (xattr_req, priv->pending_key[i], + zero_pending, 3 * sizeof (int32_t)); + if (ret < 0) { + GF_FREE (zero_pending); + gf_log (this->name, GF_LOG_WARNING, + "Unable to set dict value"); } } @@ -883,8 +893,14 @@ afr_sh_data_fxattrop (call_frame_t *frame, xlator_t *this) } } + dict_unref (xattr_req); + return 0; + +out: if (xattr_req) dict_unref (xattr_req); + sh->op_failed = 1; + afr_sh_data_done (frame, this); return 0; } |