File pacemaker-pengine-use-after-free-location.patch of Package pacemaker.3577
commit 41dd34090e02ac22a5266e47217467ffc2545bb6
Author: Ken Gaillot <kgaillot@redhat.com>
Date: Thu Jun 9 13:58:24 2016 -0500
Fix: pengine: avoid use-after-free with location constraint + sets + templates
Previously, rsc2node_new() assumed id would be persistent, but when a location
constraint involves a resource set referencing a template, unpack_location()
will use a copy of the XML and free it afterward. Now, it makes a copy of id,
and pe_free_rsc_to_node() will free that copy when appropriate.
diff --git a/pengine/pengine.h b/pengine/pengine.h
index 671cfe3..5500819 100644
--- a/pengine/pengine.h
+++ b/pengine/pengine.h
@@ -82,7 +82,7 @@ enum rsc_discover_e {
};
struct rsc_to_node_s {
- const char *id;
+ char *id;
resource_t *rsc_lh;
enum rsc_role_e role_filter;
diff --git a/pengine/utils.c b/pengine/utils.c
index 7671e04..d84559b 100644
--- a/pengine/utils.c
+++ b/pengine/utils.c
@@ -51,6 +51,7 @@ pe_free_rsc_to_node(GListPtr constraints)
iterator = iterator->next;
g_list_free_full(cons->node_list_rh, free);
+ free(cons->id);
free(cons);
}
if (constraints != NULL) {
@@ -75,7 +76,7 @@ rsc2node_new(const char *id, resource_t * rsc,
new_con = calloc(1, sizeof(rsc_to_node_t));
if (new_con != NULL) {
- new_con->id = id;
+ new_con->id = strdup(id);
new_con->rsc_lh = rsc;
new_con->node_list_rh = NULL;
new_con->role_filter = RSC_ROLE_UNKNOWN;