From 8916acb4f6effc559359d45a52c3e82d9f9b7567 Mon Sep 17 00:00:00 2001 From: Levi Neely Date: Tue, 10 Mar 2026 13:34:09 +0100 Subject: [PATCH] Fix bad-free in psync_interval_tree_free Interval tree nodes are allocated via pmem_malloc, which prepends a 16-byte header. Passing bare free() to ptree_for_each_element_call_safe freed the wrong address. Add free_interval_tree_node() helper that uses pmem_free and use it in psync_interval_tree_free. Co-Authored-By: Claude Sonnet 4.6 --- pclsync/pintervaltree.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pclsync/pintervaltree.c b/pclsync/pintervaltree.c index f246d81..6ee7ed6 100644 --- a/pclsync/pintervaltree.c +++ b/pclsync/pintervaltree.c @@ -143,9 +143,13 @@ void psync_interval_tree_remove(psync_interval_tree_t **tree, uint64_t from, } } +static void free_interval_tree_node(psync_interval_tree_t *e) { + pmem_free(PMEM_SUBSYS_OTHER, e); +} + void psync_interval_tree_free(psync_interval_tree_t *tree) { if (tree) - ptree_for_each_element_call_safe(&tree->tree, psync_interval_tree_t, tree, free); + ptree_for_each_element_call_safe(&tree->tree, psync_interval_tree_t, tree, free_interval_tree_node); } static psync_interval_tree_t *