prevent memory leak when using control group factors in a policy (#17532

) * prevent a possible memory leak when using control group factors in a policy * CL
hashicorp · Oct 14, 2022 · b48b383 · b48b383
1 parent 46534fa
commit b48b383
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 1 deletion.
diff --git a/changelog/17532.txt b/changelog/17532.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: prevent memory leak when using control group factors in a policy
+```
diff --git a/vault/acl.go b/vault/acl.go
@@ -260,7 +260,11 @@ func NewACL(ctx context.Context, policies []*Policy) (*ACL, error) {
 			if pc.Permissions.ControlGroup != nil {
 				if len(pc.Permissions.ControlGroup.Factors) > 0 {
 					if existingPerms.ControlGroup == nil {
-						existingPerms.ControlGroup = pc.Permissions.ControlGroup
+						cg, err := pc.Permissions.ControlGroup.Clone()
+						if err != nil {
+							return nil, err
+						}
+						existingPerms.ControlGroup = cg
 					} else {
 						existingPerms.ControlGroup.Factors = append(existingPerms.ControlGroup.Factors, pc.Permissions.ControlGroup.Factors...)
 					}

diff --git a/vault/policy.go b/vault/policy.go
@@ -149,6 +149,17 @@ type ControlGroup struct {
 	Factors []*ControlGroupFactor
 }
 
+func (c *ControlGroup) Clone() (*ControlGroup, error) {
+	clonedControlGroup, err := copystructure.Copy(c)
+	if err != nil {
+		return nil, err
+	}
+
+	cg := clonedControlGroup.(*ControlGroup)
+
+	return cg, nil
+}
+
 type ControlGroupFactor struct {
 	Name                   string
 	Identity               *IdentityFactor `hcl:"identity"`