From b42a6ede190585516f132a686abc53755c1b6864 Mon Sep 17 00:00:00 2001 From: Sitsofe Wheeler Date: Sat, 25 Jan 2014 08:47:49 +0000 Subject: [PATCH] OLD TESTS: Fix use after free in unsolicited_[non]immediate_data tests. After destroying iscsi, nullify iscsi_url's reference to it to prevent a use after free. Detected by clang's AddressSanitizer. --- test-tool/1041_unsolicited_immediate_data.c | 3 ++- test-tool/1042_unsolicited_nonimmediate_data.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/test-tool/1041_unsolicited_immediate_data.c b/test-tool/1041_unsolicited_immediate_data.c index 2959236..367023a 100644 --- a/test-tool/1041_unsolicited_immediate_data.c +++ b/test-tool/1041_unsolicited_immediate_data.c @@ -93,6 +93,7 @@ int T1041_unsolicited_immediate_data(const char *initiator, const char *url) */ printf("Login to target with IMMEDIATE_DATA=YES and INITIAL_R2T=YES ... "); iscsi_destroy_context(iscsi); + iscsi_url->iscsi = NULL; iscsi = iscsi_create_context(initiator); iscsi_set_targetname(iscsi, iscsi_url->target); iscsi_set_session_type(iscsi, ISCSI_SESSION_NORMAL); @@ -154,8 +155,8 @@ int T1041_unsolicited_immediate_data(const char *initiator, const char *url) finished: - iscsi_destroy_context(iscsi); iscsi_destroy_url(iscsi_url); + iscsi_destroy_context(iscsi); return ret; } diff --git a/test-tool/1042_unsolicited_nonimmediate_data.c b/test-tool/1042_unsolicited_nonimmediate_data.c index fe5f62e..46d69c8 100644 --- a/test-tool/1042_unsolicited_nonimmediate_data.c +++ b/test-tool/1042_unsolicited_nonimmediate_data.c @@ -110,6 +110,7 @@ int T1042_unsolicited_nonimmediate_data(const char *initiator, const char *url) */ printf("Login to target with IMMEDIATE_DATA=NO and INITIAL_R2T=NO ... "); iscsi_destroy_context(iscsi); + iscsi_url->iscsi = NULL; iscsi = iscsi_create_context(initiator); iscsi_set_targetname(iscsi, iscsi_url->target); iscsi_set_session_type(iscsi, ISCSI_SESSION_NORMAL); @@ -172,8 +173,8 @@ int T1042_unsolicited_nonimmediate_data(const char *initiator, const char *url) finished: - iscsi_destroy_context(iscsi); iscsi_destroy_url(iscsi_url); + iscsi_destroy_context(iscsi); return ret; }