From 5c32359f3eaf1ec17e187b898571b229b06bb213 Mon Sep 17 00:00:00 2001 From: leecher1337 Date: Sun, 3 Dec 2017 17:53:41 +0100 Subject: [PATCH] Fixed severe double-free bug on mdb_clone_handle with immediate mdb_close() afterwards leading to memory corruption --- src/libmdb/file.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/libmdb/file.c b/src/libmdb/file.c index f8fc175..0af9a03 100644 --- a/src/libmdb/file.c +++ b/src/libmdb/file.c @@ -327,6 +327,7 @@ MdbHandle *mdb_clone_handle(MdbHandle *mdb) for (i=0;inum_catalog;i++) { entry = g_ptr_array_index(mdb->catalog,i); data = g_memdup(entry,sizeof(MdbCatalogEntry)); + data->props = NULL; g_ptr_array_add(newmdb->catalog, data); } mdb->backend_name = NULL;