Dereferencing freed pointer

Bug #1026293 reported by Steven Lougheed
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
mosquitto
Fix Released
Undecided
Unassigned

Bug Description

In function mqtt3_db_message_store in database.c the 'temp' pointer is freed and then dereferenced in a subsequent call to _mosquitto_free().

Line 464: _mosquitto_free(temp);
Line 465: _mosquitto_free(temp->source_id);

This seems bad.

Revision history for this message
Roger Light (roger.light) wrote :

It does seem bad. I've fixed it in this changeset: https://bitbucket.org/oojah/mosquitto/changeset/abe0ccd67aaf

Thanks for reporting it.

Changed in mosquitto:
milestone: none → 1.0
status: New → Fix Committed
Revision history for this message
Steven Lougheed (slougheed) wrote :

Thanks for creating a great project and for the remarkably fast response times.

Changed in mosquitto:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.