From 1fec35c3c7e212e41224035e1c04e2c211634d72 Mon Sep 17 00:00:00 2001 From: Donald Sharp Date: Wed, 14 Dec 2022 15:53:06 -0500 Subject: [PATCH] lib: Fix free function The list delete function on creation was set to srv6_locator_chunk_free Which takes a double pointer and dereferences it to free the data. When list_delete is called it calls the delete function like this: if (*list->del) (*list->del)(node->data); The data is not passed in by reference and as such we do not have a double pointer. Fortunately this list_delete is only really called on shutdown when the locator was deleted and we do not have a fun situation where we were suddenly freeing 'something'. Signed-off-by: Donald Sharp --- lib/srv6.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/lib/srv6.c b/lib/srv6.c index 5cd82080f5..f4077a86d2 100644 --- a/lib/srv6.c +++ b/lib/srv6.c @@ -121,6 +121,13 @@ const char *seg6local_context2str(char *str, size_t size, } } +static void srv6_locator_chunk_list_free(void *data) +{ + struct srv6_locator_chunk *chunk = data; + + srv6_locator_chunk_free(&chunk); +} + struct srv6_locator *srv6_locator_alloc(const char *name) { struct srv6_locator *locator = NULL; @@ -128,7 +135,7 @@ struct srv6_locator *srv6_locator_alloc(const char *name) locator = XCALLOC(MTYPE_SRV6_LOCATOR, sizeof(struct srv6_locator)); strlcpy(locator->name, name, sizeof(locator->name)); locator->chunks = list_new(); - locator->chunks->del = (void (*)(void *))srv6_locator_chunk_free; + locator->chunks->del = srv6_locator_chunk_list_free; QOBJ_REG(locator, srv6_locator); return locator; -- 2.39.5