admin/libiscsi
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

test-tool: Avoid that using receive_copy_results() triggers a use-after-free

Browse Source 
Move the scsi_free_scsi_task() call from receive_copy_results() to the
callers of this function to avoid that accessing the unmarshalled data
triggers a use-after-free.

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
This commit is contained in:
Bart Van Assche
2015-09-26 20:51:49 -07:00
committed by Ronnie Sahlberg
parent cacc144a29
commit be9b803334
5 changed files with 42 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
test-tool/test_extendedcopy_descr_limits.c
View File

@@ -52,6 +52,7 @@ void
test_extendedcopy_descr_limits(void)
{
int ret;
struct scsi_task *edl_task;
struct iscsi_data data;
unsigned char *xcopybuf;
struct scsi_copy_results_op_params *opp;
@@ -64,12 +65,12 @@ test_extendedcopy_descr_limits(void)
CHECK_FOR_DATALOSS;
logging(LOG_VERBOSE, "Issue RECEIVE COPY RESULTS (OPERATING PARAMS)");
ret = receive_copy_results(sd, SCSI_COPY_RESULTS_OP_PARAMS, 0,
(void **)&opp, EXPECT_STATUS_GOOD);
ret = receive_copy_results(&edl_task, sd, SCSI_COPY_RESULTS_OP_PARAMS, 0,
(void **)&opp, EXPECT_STATUS_GOOD);
if (ret < 0) {
CU_PASS("[SKIPPED] Target does not support "
"RECEIVE_COPY_RESULTS. Skipping test");
return;
goto out;
}
CU_ASSERT_EQUAL(ret, 0);
@@ -95,7 +96,7 @@ test_extendedcopy_descr_limits(void)
if (ret == -2) {
CU_PASS("[SKIPPED] Target does not support "
"EXTENDED_COPY. Skipping test");
return;
goto out;
}
CU_ASSERT_EQUAL(ret, 0);
@@ -123,4 +124,7 @@ test_extendedcopy_descr_limits(void)
ret = extendedcopy(sd, &data, EXPECT_PARAM_LIST_LEN_ERR);
CU_ASSERT_EQUAL(ret, 0);
}
out:
scsi_free_scsi_task(edl_task);
}