[Emacs-diffs] master 2ea55c2: Fix double-free in pdumper

[Paul Eggert]

branch: master
commit 2ea55c2774e726c7e393ee81b152aa9734c410cb
Author: Paul Eggert <address@hidden>
Commit: Paul Eggert <address@hidden>

    Fix double-free in pdumper
    
    Revert the double-free bug that I introduced in
    2019-03-11T15:20:address@hidden
    * src/pdumper.c (dump_mmap_reset): Do not free the private member;
    that’s the release function’s job.
    (dump_mm_heap_cb_release): Free cb if its refcount goes to zero.
    (dump_mmap_contiguous_heap): Mention memory leak in comment.
---
 src/pdumper.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/pdumper.c b/src/pdumper.c
index 5bc5bb4..3facd52 100644
--- a/src/pdumper.c
+++ b/src/pdumper.c
@@ -4623,9 +4623,7 @@ dump_mmap_reset (struct dump_memory_map *map)
 {
   map->mapping = NULL;
   map->release = NULL;
-  void *private = map->private;
   map->private = NULL;
-  free (private);
 }
 
 static void
@@ -4648,7 +4646,10 @@ dump_mm_heap_cb_release (struct 
dump_memory_map_heap_control_block *cb)
 {
   eassert (cb->refcount > 0);
   if (--cb->refcount == 0)
-    free (cb->mem);
+    {
+      free (cb->mem);
+      free (cb);
+    }
 }
 
 static void
@@ -4663,7 +4664,12 @@ dump_mmap_contiguous_heap (struct dump_memory_map *maps, 
int nr_maps,
                           size_t total_size)
 {
   bool ret = false;
+
+  /* FIXME: This storage sometimes is never freed.
+     Beware: the simple patch 2019-03-11T15:20:address@hidden
+     is worse, as it sometimes frees this storage twice.  */
   struct dump_memory_map_heap_control_block *cb = calloc (1, sizeof (*cb));
+
   char *mem;
   if (!cb)
     goto out;