Skip to contentSkip to conversation

sam460ex: Correct use after free error

PATCH Applied BALATON Zoltan 3 participants 3 messages Jul 15, 2018 – Jul 16, 2018

lore
Share & tools
lore

BALATON Zoltan

author
#0 lore raw

PATCH 1/1 sam460ex: Correct use after free error

Commit 51b0d834c changed error handling to report file name in error message but forgot to move freeing it after usage. Noticed by Coverity.

Fixes CID 1394217
Reported-by Paolo Bonzini <[email protected]>
Signed-off-by BALATON Zoltan <[email protected]>
---
 hw/ppc/sam460ex.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
hw/ppc/sam460ex.c +2 -1
index e2b7028..0999efc 100644
@@ -269,11 +269,12 @@ static int sam460ex_load_device_tree(hwaddr addr,
         exit(1);
     }
     fdt = load_device_tree(filename, &fdt_size);
-    g_free(filename);
     if (!fdt) {
         error_report("Couldn't load dtb file `%s'", filename);
+        g_free(filename);
         exit(1);
     }
+    g_free(filename);
 
     /* Manipulate device tree in memory. */
Signature · 1 line
2.7.6
Reviewed-by on v1 1/1
#1 lore raw
Quoted 6 lines · BALATON Zoltan

Commit 51b0d834c changed error handling to report file name in error message but forgot to move freeing it after usage. Noticed by Coverity.

Fixes CID 1394217
Reported-by Paolo Bonzini <[email protected]>
Signed-off-by BALATON Zoltan <[email protected]>
Reviewed-by Philippe Mathieu-Daudé <[email protected]>
Quoted 23 lines
---
 hw/ppc/sam460ex.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
hw/ppc/sam460ex.c +2 -1
index e2b7028..0999efc 100644
@@ -269,11 +269,12 @@ static int sam460ex_load_device_tree(hwaddr addr,
         exit(1);
     }
     fdt = load_device_tree(filename, &fdt_size);
-    g_free(filename);
     if (!fdt) {
         error_report("Couldn't load dtb file `%s'", filename);
+        g_free(filename);
         exit(1);
     }
+    g_free(filename);
 
     /* Manipulate device tree in memory. */
Applied
#2 lore raw
In reply to BALATON Zoltan
Quoted 6 lines · BALATON Zoltan

Commit 51b0d834c changed error handling to report file name in error message but forgot to move freeing it after usage. Noticed by Coverity.

Fixes CID 1394217
Reported-by Paolo Bonzini <[email protected]>
Signed-off-by BALATON Zoltan <[email protected]>

Applied to ppc-for-3.0, thanks.

Quoted 22 lines
---
 hw/ppc/sam460ex.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
hw/ppc/sam460ex.c +2 -1
index e2b7028..0999efc 100644
@@ -269,11 +269,12 @@ static int sam460ex_load_device_tree(hwaddr addr,
         exit(1);
     }
     fdt = load_device_tree(filename, &fdt_size);
-    g_free(filename);
     if (!fdt) {
         error_report("Couldn't load dtb file `%s'", filename);
+        g_free(filename);
         exit(1);
     }
+    g_free(filename);
 
     /* Manipulate device tree in memory. */
Signature · 4 lines
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson