ovsdb: Fix use-after-free error in ovsdb_destroy().
authorBen Pfaff <blp@nicira.com>
Fri, 6 Nov 2009 21:36:41 +0000 (13:36 -0800)
committerBen Pfaff <blp@nicira.com>
Fri, 6 Nov 2009 23:33:47 +0000 (15:33 -0800)
ovsdb/ovsdb.c

index e653758fd0a5975fef1daf4e51e2505d174bd3ba..1a4b6d8dad785682da340d0e3a8eab818d2142a2 100644 (file)
@@ -245,9 +245,10 @@ ovsdb_destroy(struct ovsdb *db)
         }
         shash_destroy(&db->tables);
 
-        /* Clear the schema's hash of table schemas.  The schemas, but not the
-         * table that points to them, were deleted in the previous step. */
-        shash_destroy(&db->schema->tables);
+        /* The schemas, but not the table that points to them, were deleted in
+         * the previous step, so we need to clear out the table.  We can't
+         * destroy the table, because ovsdb_schema_destroy() will do that. */
+        shash_clear(&db->schema->tables);
 
         ovsdb_schema_destroy(db->schema);
         ovsdb_file_close(db->file);