[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[PATCH] xeniface: fix double-free of Path in IoctlStoreAddWatch fail8 path


  • To: win-pv-devel@xxxxxxxxxxxxxxxxxxxx
  • From: david ambu <david.preetham@xxxxxxxxxx>
  • Date: Tue, 13 Oct 2026 16:39:15 +0100
  • Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=citrix.com header.i="@citrix.com" header.h="Content-Transfer-Encoding:MIME-Version:Message-ID:Date:Subject:Cc:To:From"
  • Cc: david ambu <david.preetham@xxxxxxxxxx>
  • Delivery-date: Tue, 13 Oct 2026 15:40:17 +0000
  • List-id: Developer list for the Windows PV Drivers subproject <win-pv-devel.lists.xenproject.org>

Context->Path and Path point to the same buffer. On WatchAdd failure,
fail8 freed Context->Path then fell through to fail4 which freed Path
again, causing a double-free and heap corruption.

Remove the free from fail8; fail4 already handles it via the Path
variable.

Signed-off-by: david ambu <david.preetham@xxxxxxxxxx>
Assisted by Claude Sonnet 4.6
---
 src/xeniface/ioctl_store.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/src/xeniface/ioctl_store.c b/src/xeniface/ioctl_store.c
index e0072f0..c3beca2 100644
--- a/src/xeniface/ioctl_store.c
+++ b/src/xeniface/ioctl_store.c
@@ -602,8 +602,6 @@ IoctlStoreAddWatch(
     return status;
 
 fail8:
-    __FreeCapturedBuffer(Context->Path);
-
     Error("Fail8\n");
     ThreadAlert(Context->Thread);
     ThreadJoin(Context->Thread);
-- 
2.51.0.windows.1




 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.