From: Casey Bodley <cbodley@redhat.com>
Date: Tue, 26 Apr 2016 14:36:58 +0000 (-0400)
Subject: rgw: fix bad free in RGWCreateBucket_ObjStore_S3
X-Git-Tag: v11.0.0~816^2
X-Git-Url: http://git.apps.os.sepia.ceph.com/?a=commitdiff_plain;h=7251dbeed4f3f194b2548b986a071fa426487760;p=ceph-ci.git

rgw: fix bad free in RGWCreateBucket_ObjStore_S3

get_params() will accept -ERR_LENGTH_REQUIRED from
rgw_rest_read_all_input(), in which case 'data' will not be allocated
and we attempt to free() an uninitialized pointer

Fixes: http://tracker.ceph.com/issues/15595

Signed-off-by: Casey Bodley <cbodley@redhat.com>
---

diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index 04ee28f0175..abf15f4e64a 100644
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -918,12 +918,12 @@ int RGWCreateBucket_ObjStore_S3::get_params()
   policy = s3policy;
 
   int len = 0;
-  char *data;
+  char *data = nullptr;
 #define CREATE_BUCKET_MAX_REQ_LEN (512 * 1024) /* this is way more than enough */
   op_ret = rgw_rest_read_all_input(s, &data, &len, CREATE_BUCKET_MAX_REQ_LEN);
   if ((op_ret < 0) && (op_ret != -ERR_LENGTH_REQUIRED))
     return op_ret;
-  
+
   auto data_deleter = std::unique_ptr<char, decltype(free)*>{data, free};
 
   if (s->aws4_auth_needs_complete) {