From bc82430a6f86ccaad80831c5c2e19fb67d1574b0 Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" Date: Sat, 1 May 2021 08:48:24 -0600 Subject: [PATCH] Set relay name string to NULL after dropping the reference. Otherwise it is possible to decrement the reference more than once. --- logsrvd/logsrvd_relay.c | 1 + 1 file changed, 1 insertion(+) diff --git a/logsrvd/logsrvd_relay.c b/logsrvd/logsrvd_relay.c index 8b0a826e1..679fd0037 100644 --- a/logsrvd/logsrvd_relay.c +++ b/logsrvd/logsrvd_relay.c @@ -400,6 +400,7 @@ bad: if (sock != -1) close(sock); sudo_rcstr_delref(relay_closure->relay_name.name); + relay_closure->relay_name.name = NULL; sudo_ev_free(relay_closure->connect_ev); relay_closure->connect_ev = NULL; debug_return_int(-1);