-
Alejandro Sanchez authored
Code calls list_find_first to search in resv_list whether the requested name for the new reservation already exists. If it exists, resv_ptr is set with the pointer to the existing reservation. Then the code goto bad_parse label and xfreed that resv_ptr, thus corrupting the list data by freeing the existing reservation. This is fixed by only freeing memory on the new local resv_ptr instead of always freeing memory. xfree is also not sufficient for freeing the memory, we needed to call _del_resv_rec() or we would leak the memory we had transferred from the resv_desc_ptr. This also involved NULLing out the other variables freed after bad_parse, or you would get double frees. Bug 3558.
07ce0773
To find the state of this project's repository at the time of any of these versions, check out the tags.