lib: Fix use after free in fuse_flush()

diff --git a/ChangeLog b/ChangeLog
index a28a5b0f054a475c62b76dc1d6d80d27455bd46c..57f5e37f055a1606f817883d2e0b458801e70de8 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2006-12-15  Miklos Szeredi <miklos@szeredi.hu>
+
+       * lib: Fix use after free in fuse_flush().  Reported by Ron
+       Lindman
+
 2006-12-04  Miklos Szeredi <miklos@szeredi.hu>
 
        * Fix warnings with gcc-4.1 on 64bit archs.  Report from

diff --git a/lib/fuse.c b/lib/fuse.c
index 4446245096dc44935a05ff4dad56baee912a84b2..f63c866223d32f9b36eaf19e4212f06ff05f1f08 100644 (file)
--- a/lib/fuse.c
+++ b/lib/fuse.c
@@ -2295,7 +2295,6 @@ static void fuse_flush(fuse_req_t req, fuse_ino_t ino,
         err = -ENOSYS;
         if (f->op.flush)
             err = fuse_do_flush(f, req, path, fi);
-        free(path);
     }
     if (f->op.lock) {
         struct flock lock;
@@ -2314,6 +2313,7 @@ static void fuse_flush(fuse_req_t req, fuse_ino_t ino,
         if (err == -ENOSYS)
             err = 0;
     }
+    free(path);
     pthread_rwlock_unlock(&f->tree_lock);
     reply_err(req, err);
 }