Fix: double-free on error sending fields

Found by Coverity:
*** CID 1348462:    (USE_AFTER_FREE)

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>

diff --git a/liblttng-ust-comm/lttng-ust-comm.c b/liblttng-ust-comm/lttng-ust-comm.c
index d213770f7a25f69059810d14d5f12569636cba2b..cee1b694333c8a264955c079692908ff6b49d792 100644 (file)
--- a/liblttng-ust-comm/lttng-ust-comm.c
+++ b/liblttng-ust-comm/lttng-ust-comm.c
@@ -947,47 +947,49 @@ int ustcomm_register_event(int sock,
        msg.m.model_emf_uri_len = model_emf_uri_len;
        len = ustcomm_send_unix_sock(sock, &msg, sizeof(msg));
        if (len > 0 && len != sizeof(msg)) {
-               free(fields);
-               return -EIO;
+               ret = -EIO;
+               goto error_fields;
        }
        if (len < 0) {
-               free(fields);
-               return len;
+               ret = len;
+               goto error_fields;
        }
 
        /* send signature */
        len = ustcomm_send_unix_sock(sock, signature, signature_len);
        if (len > 0 && len != signature_len) {
-               free(fields);
-               return -EIO;
+               ret = -EIO;
+               goto error_fields;
        }
        if (len < 0) {
-               free(fields);
-               return len;
+               ret = len;
+               goto error_fields;
        }
 
        /* send fields */
        if (fields_len > 0) {
                len = ustcomm_send_unix_sock(sock, fields, fields_len);
-               free(fields);
                if (len > 0 && len != fields_len) {
-                       return -EIO;
+                       ret = -EIO;
+                       goto error_fields;
                }
                if (len < 0) {
-                       return len;
+                       ret = len;
+                       goto error_fields;
                }
-       } else {
-               free(fields);
        }
+       free(fields);
 
        if (model_emf_uri_len) {
                /* send model_emf_uri */
                len = ustcomm_send_unix_sock(sock, model_emf_uri,
                                model_emf_uri_len);
-               if (len > 0 && len != model_emf_uri_len)
+               if (len > 0 && len != model_emf_uri_len) {
                        return -EIO;
-               if (len < 0)
+               }
+               if (len < 0) {
                        return len;
+               }
        }
 
        /* receive reply */
@@ -1021,6 +1023,12 @@ int ustcomm_register_event(int sock,
                        return len;
                }
        }
+       /* Unreached. */
+
+       /* Error path only. */
+error_fields:
+       free(fields);
+       return ret;
 }
 
 /*