rsync - Nov 2009 - A crash when syncing xattr with rsync-3.0.6

Hi,

I have a crash running rsync-3.0.6 and using the -X flag.
The crash was in uncache_tmp_xattrs() when free was called on every
xattr_item. However, the rsync_xal_l.items is a buffer, not a list,
and so only the whole buffer should be freed, and not every item.

Can anyone with git access please fix this?

This is the patch:

--- rsync-3.0.6/xattrs.c        2009-11-30 14:16:53.501050939 +0200
+++ rsync-3.0.6/xattrs.c.new    2009-11-30 14:40:58.839777618 +0200
@@ -748,7 +748,6 @@
                rsync_xal_l.count = prior_xattr_count;
                while (xattr_item-- > xattr_start) {
                        rsync_xal_free(xattr_item);
-                       free(xattr_item);
                }
                prior_xattr_count = (size_t)-1;
        }



Thanks,
Amir

On Mon, Nov 30, 2009 at 4:46 AM, Amir Rapson <amir.rapson at gmail.com>
wrote:
> I have a crash running rsync-3.0.6 and using the -X flag.
>
This has been fixed in git since mid August (with the freeing of the proper
pointer, not the removal of the free() call.)  See the b3.0.x branch.  I'm
thinking about releasing a 3.0.7 with that fix and a few others.

..wayne..
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.samba.org/pipermail/rsync/attachments/20091201/4fcb65ff/attachment.html>