trace-cmd: Make print op NULL on error of processing arg

If the processing of an arg fails, it frees the given token.
But in this case, the token happens to also be assigned to an op.
If the parsing fails, then the op may be freed twice causing glibc
to abort.

Reported-by: John Kacur <jkacur@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

1 files changed, 5 insertions, 0 deletions

diff --git a/parse-events.c b/parse-events.c
index 9f88472..53aad3e 100644
--- a/parse-events.c
+++ b/parse-events.c
@@ -2183,6 +2183,11 @@ process_arg_token(struct event_format *event, struct print_arg *arg,
                 arg->op.op = token;
                 arg->op.left = NULL;
                 type = process_op(event, arg, &token);
+
+                /* On error, the op is freed */
+                if (type == EVENT_ERROR)
+                        arg->op.op = NULL;
+
                 /* return error type if errored */
                 break;