debugreiserfs: fix use after free while closing log
reiserfs_close(fs) frees fs and we were using it after freeing
to close the log.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
diff --git a/debugreiserfs/debugreiserfs.c b/debugreiserfs/debugreiserfs.c
index edd89db..89bfece 100644
--- a/debugreiserfs/debugreiserfs.c
+++ b/debugreiserfs/debugreiserfs.c
@@ -686,6 +686,7 @@
char *file_name;
int error;
struct debugreiserfs_data *data;
+ FILE *log;
data = getmem(sizeof(struct debugreiserfs_data));
file_name = parse_options(data, argc, argv);
@@ -777,9 +778,9 @@
break;
}
+ log = data(fs)->log;
reiserfs_close(fs);
- if (data(fs)->log) {
- fclose(data(fs)->log);
- }
+ if (log)
+ fclose(log);
return 0;
}
