Fix regression in b894280a.
Code calls list_find_first to search in resv_list whether the requested name for the new reservation already exists. If it exists, resv_ptr is set with the pointer to the existing reservation. Then the code goto bad_parse label and xfreed that resv_ptr, thus corrupting the list data by freeing the existing reservation. This is fixed by only freeing memory on the new local resv_ptr instead of always freeing memory. xfree is also not sufficient for freeing the memory, we needed to call _del_resv_rec() or we would leak the memory we had transferred from the resv_desc_ptr. This also involved NULLing out the other variables freed after bad_parse, or you would get double frees. Bug 3558.
Please register or sign in to comment