db: properly handle a reduction in arch filters on transaction commits

Fix an off-by-one error that was causing us to leak a db_filter struct at transaction commit time when we removed an arch/ABI in a transaction. Reported-by: Tom Hromatka <[email protected]> Signed-off-by: Paul Moore <[email protected]> Signed-off-by: Tom Hromatka <[email protected]> (imported from commit 557a788) Signed-off-by: Paul Moore <[email protected]> Signed-off-by: Tom Hromatka <[email protected]>
seccomp · Dec 16, 2024 · 2fdc8dc · 2fdc8dc
1 parent 424ee9a
commit 2fdc8dc
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/src/db.c b/src/db.c
@@ -2570,8 +2570,8 @@ void db_col_transaction_commit(struct db_filter_col *col)
 		 *       at the cost of a not reaping all the memory possible */
 
 		do {
-			_db_release(snap->filters[snap->filter_cnt--]);
-		} while (snap->filter_cnt > col->filter_cnt);
+			_db_release(snap->filters[--snap->filter_cnt]);
+		} while (col->filter_cnt < snap->filter_cnt);
 	}
 
 	/* loop through each filter and update the rules on the snapshot */