Merge pull request #244 from nalind/doublefree-1.13.1

Fix potential double-frees in the journal log reader

Author: runcom

daemon/logger/journald/read.go

@@ -237,14 +237,20 @@ drain:
 
 	// free(NULL) is safe
 	C.free(unsafe.Pointer(oldCursor))
-	C.sd_journal_get_cursor(j, &cursor)
+	if C.sd_journal_get_cursor(j, &cursor) != 0 {
+		// ensure that we won't be freeing an address that's invalid
+		cursor = nil
+	}
 	return cursor
 }
 
 func (s *journald) followJournal(logWatcher *logger.LogWatcher, config logger.ReadConfig, j *C.sd_journal, pfd [2]C.int, cursor *C.char) *C.char {
 	s.readers.mu.Lock()
 	s.readers.readers[logWatcher] = logWatcher
 	s.readers.mu.Unlock()
+
+	newCursor := make(chan *C.char)
+
 	go func() {
 		// Keep copying journal data out until we're notified to stop
 		// or we hit an error.
@@ -271,8 +277,8 @@ func (s *journald) followJournal(logWatcher *logger.LogWatcher, config logger.Re
 		s.readers.mu.Lock()
 		delete(s.readers.readers, logWatcher)
 		s.readers.mu.Unlock()
-		C.sd_journal_close(j)
 		close(logWatcher.Msg)
+		newCursor <- cursor
 	}()
 	// Wait until we're told to stop.
 	select {
@@ -281,6 +287,8 @@ func (s *journald) followJournal(logWatcher *logger.LogWatcher, config logger.Re
 		C.close(pfd[1])
 	}
 
+	cursor = <-newCursor
+
 	return cursor
 }
 
@@ -305,9 +313,9 @@ func (s *journald) readLogs(logWatcher *logger.LogWatcher, config logger.ReadCon
 	following := false
 	defer func(pfollowing *bool) {
 		if !*pfollowing {
-			C.sd_journal_close(j)
 			close(logWatcher.Msg)
 		}
+		C.sd_journal_close(j)
 	}(&following)
 	// Remove limits on the size of data items that we'll retrieve.
 	rc = C.sd_journal_set_data_threshold(j, C.size_t(0))