dany/u-boot-megous
1
0
Fork 0
mirror of https://xff.cz/git/u-boot/ synced 2025-10-31 10:26:10 +01:00
Code Issues Packages Projects Releases Wiki Activity

fs/squashfs: sqfs_split_path: fix memory leak and dangling pointers

Browse Source 
*file and *dir were not freed on error

Reviewed-by: Joao Marcos Costa <jmcosta944@gmail.com>
Signed-off-by: Richard Genoud <richard.genoud@posteo.net>
This commit is contained in:
Richard Genoud
2020-11-03 12:11:03 +01:00
committed by Tom Rini
parent 87d11e08e4
commit 5487477802
1 changed files with 28 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
fs/squashfs/sqfs.c
View File

@@ -1089,15 +1089,27 @@ static int sqfs_split_path(char **file, char **dir, const char *path)
char *dirc, *basec, *bname, *dname, *tmp_path; char *dirc, *basec, *bname, *dname, *tmp_path;
int ret = 0; int ret = 0;
*file = NULL;
*dir = NULL;
dirc = NULL;
basec = NULL;
bname = NULL;
dname = NULL;
tmp_path = NULL;
/* check for first slash in path*/ /* check for first slash in path*/
if (path[0] == '/') { if (path[0] == '/') {
tmp_path = strdup(path); tmp_path = strdup(path);
if (!tmp_path) if (!tmp_path) {
return -ENOMEM; ret = -ENOMEM;
goto out;
}
} else { } else {
tmp_path = malloc(strlen(path) + 2); tmp_path = malloc(strlen(path) + 2);
if (!tmp_path) if (!tmp_path) {
return -ENOMEM; ret = -ENOMEM;
goto out;
}
tmp_path[0] = '/'; tmp_path[0] = '/';
strcpy(tmp_path + 1, path); strcpy(tmp_path + 1, path);
} }
@@ -1106,13 +1118,13 @@ static int sqfs_split_path(char **file, char **dir, const char *path)
dirc = strdup(tmp_path); dirc = strdup(tmp_path);
if (!dirc) { if (!dirc) {
ret = -ENOMEM; ret = -ENOMEM;
goto free_tmp; goto out;
} }
basec = strdup(tmp_path); basec = strdup(tmp_path);
if (!basec) { if (!basec) {
ret = -ENOMEM; ret = -ENOMEM;
goto free_dirc; goto out;
} }
dname = sqfs_dirname(dirc); dname = sqfs_dirname(dirc);
@@ -1122,14 +1134,14 @@ static int sqfs_split_path(char **file, char **dir, const char *path)
if (!*file) { if (!*file) {
ret = -ENOMEM; ret = -ENOMEM;
goto free_basec; goto out;
} }
if (*dname == '\0') { if (*dname == '\0') {
*dir = malloc(2); *dir = malloc(2);
if (!*dir) { if (!*dir) {
ret = -ENOMEM; ret = -ENOMEM;
goto free_basec; goto out;
} }
(*dir)[0] = '/'; (*dir)[0] = '/';
@@ -1138,15 +1150,19 @@ static int sqfs_split_path(char **file, char **dir, const char *path)
*dir = strdup(dname); *dir = strdup(dname);
if (!*dir) { if (!*dir) {
ret = -ENOMEM; ret = -ENOMEM;
goto free_basec; goto out;
} }
} }
free_basec: out:
if (ret) {
free(*file);
free(*dir);
*dir = NULL;
*file = NULL;
}
free(basec); free(basec);
free_dirc:
free(dirc); free(dirc);
free_tmp:
free(tmp_path); free(tmp_path);
return ret; return ret;