26e33b1 util/sss_ptr_hash: fixed double free in sss_ptr_hash_delete_cb()

1 file Authored by atikhonov 4 years ago, Committed by pbrezina 4 years ago,
    util/sss_ptr_hash: fixed double free in sss_ptr_hash_delete_cb()
    
    Calling data->callback(value->ptr) in sss_ptr_hash_delete_cb() could lead
    to freeing of value->ptr and thus to destruction of value->spy that is
    attached to value->ptr.
    In turn sss_ptr_hash_spy_destructor() calls sss_ptr_hash_delete() ->
    hash_delete() -> sss_ptr_hash_delete_cb() again and in this recursive
    execution hash entry was actually deleted and value was freed.
    When stack was unwound back to "first" sss_ptr_hash_delete_cb() it tried
    to free value again => double free.
    
    To prevent this bug value and hence spy are now freed before execution of
    data->callback(value->ptr).
    
    Resolves: https://pagure.io/SSSD/sssd/issue/4135
    
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>
    
        
file modified
+3 -3