lib:util: Avoid free'ing our own pointer

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14625

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 0bdbe50fac680be3fe21043246b8c75005611351)

Autobuild-User(v4-14-test): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(v4-14-test): Tue Feb  9 13:31:03 UTC 2021 on sn-devel-184

diff --git a/lib/util/memcache.c b/lib/util/memcache.c
index 1e616bd0e9a9cc7eb5f0618338adcb22be5c6be2..7b0b27eaddba6bbe9c619895bc6ef30d55920459 100644 (file)
--- a/lib/util/memcache.c
+++ b/lib/util/memcache.c
@@ -223,14 +223,25 @@ static void memcache_delete_element(struct memcache *cache,
        TALLOC_FREE(e);
 }
 
-static void memcache_trim(struct memcache *cache)
+static void memcache_trim(struct memcache *cache, struct memcache_element *e)
 {
+       struct memcache_element *tail = NULL;
+
        if (cache->max_size == 0) {
                return;
        }
 
-       while ((cache->size > cache->max_size) && DLIST_TAIL(cache->mru)) {
-               memcache_delete_element(cache, DLIST_TAIL(cache->mru));
+       for (tail = DLIST_TAIL(cache->mru);
+            (cache->size > cache->max_size) && (tail != NULL);
+            tail = DLIST_TAIL(cache->mru))
+       {
+               if (tail == e) {
+                       tail = DLIST_PREV(tail);
+                       if (tail == NULL) {
+                               break;
+                       }
+               }
+               memcache_delete_element(cache, tail);
        }
 }
 
@@ -351,7 +362,7 @@ void memcache_add(struct memcache *cache, enum memcache_number n,
                memcpy(&mtv, cache_value.data, sizeof(mtv));
                cache->size += mtv.len;
        }
-       memcache_trim(cache);
+       memcache_trim(cache, e);
 }
 
 void memcache_add_talloc(struct memcache *cache, enum memcache_number n,

diff --git a/selftest/knownfail.d/memcache b/selftest/knownfail.d/memcache
deleted file mode 100644 (file)
index 0a74ace..0000000
--- a/selftest/knownfail.d/memcache
+++ /dev/null
@@ -1 +0,0 @@
-^samba.unittests.memcache.torture_memcache_add_oversize