writetape_close flushtape double free about tarsnap HOT 5 CLOSED

I can confirm this behaviour; easiest way to test is to make line 765 of tar/multitape/multitape_write.c into goto err2;

I am working on a fix and investigating potential related issues now.

from tarsnap.

Setting d->*.index to NULL after freeing them avoids the double-free, but it leaves some memory leaks.

BTW, thank you for this report! (sorry for forgetting to add this to the previous comment)

from tarsnap.

I'm pretty sure the free() calls in the error-handling path of flushtape should be free(tmi.Xindex); for X = 't', 'c', 'h'. Graham, since you presumably have valgrind set up to confirm this bug, can you see if that change fixes it?

from tarsnap.

That was the conclusion I reached, and I verified the fix easily with regular archives, but I had some issues tested it with checkpoints. I've resolved those, and it works there too. PR #101

from tarsnap.

Thanks, merged. @Safari77, do you have a Tarsnap account? This is worth a $20 bug bounty.

from tarsnap.