search

haibbo / improxy

IGMP/MLD Proxy which supports IGMPv3 and MLDv2 completely
27 stars 14 forks source link

access to a memory that has been free #2

Open githubfean opened 9 years ago

githubfean commented 9 years ago

Dear author: I would like to report a problem (bug).

at source_timer_handler() in data.c, the code segment could have crash risk.

The imp_group_cleanup(p_gp) will free (p_gp) at end of that function. After return, the last line "imp_membership_db_update(&p_gp->group_addr);"

reference it again. But p_gp is freed. So, that could have problem with some compiler or system..

if(p_gp->type == GROUP_INCLUDE && imp_source_exist_allow(p_gp) == 0){

    /* If there are no more source records for the group, delete group record.
     * rfc 3376 [6.3]
     */
    imp_group_cleanup(p_gp);
}
imp_membership_db_update(&p_gp->group_addr);