Skip to contentSkip to conversation

vvfat: Fix memory leak

PATCH In review Kevin Wolf 3 participants 3 messages Nov 14, 2018 Block layer

lore
Share & tools
lore

Kevin Wolf

author
#0 lore raw

PATCH 1/1 vvfat: Fix memory leak

Don't leak 'cluster' in the mapping == NULL case. Found by Coverity (CID 1055918).

Fixes 8d9401c2791ee2d2805b741b1ee3006041edcd3e
Signed-off-by Kevin Wolf <[email protected]>
---
 block/vvfat.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
block/vvfat.c +3 -3
index 1de5de1db4..b7b61ea8b7 100644
@@ -2510,7 +2510,7 @@ static int commit_one_file(BDRVVVFATState* s,
     uint32_t first_cluster = c;
     mapping_t* mapping = find_mapping_for_cluster(s, c);
     uint32_t size = filesize_of_direntry(direntry);
-    char* cluster = g_malloc(s->cluster_size);
+    char *cluster;
     uint32_t i;
     int fd = 0;
 

@@ -2528,17 +2528,17 @@ static int commit_one_file(BDRVVVFATState* s,
     if (fd < 0) {
         fprintf(stderr, "Could not open %s... (%s, %d)\n", mapping->path,
                 strerror(errno), errno);
-        g_free(cluster);
         return fd;
     }
     if (offset > 0) {
         if (lseek(fd, offset, SEEK_SET) != offset) {
             qemu_close(fd);
-            g_free(cluster);
             return -3;
         }
     }
 
+    cluster = g_malloc(s->cluster_size);
+
     while (offset < size) {
         uint32_t c1;
         int rest_size = (size - offset > s->cluster_size ?
Signature · 1 line
2.19.1
Reviewed-by Tested-by on v1 1/1
#1 lore raw
Quoted 5 lines · Kevin Wolf

Don't leak 'cluster' in the mapping == NULL case. Found by Coverity (CID 1055918).

Fixes 8d9401c2791ee2d2805b741b1ee3006041edcd3e
Signed-off-by Kevin Wolf <[email protected]>
Reviewed-by Philippe Mathieu-Daudé <[email protected]>
Tested-by Philippe Mathieu-Daudé <[email protected]>
Quoted 38 lines
---
  block/vvfat.c | 6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)
block/vvfat.c +3 -3
index 1de5de1db4..b7b61ea8b7 100644
@@ -2510,7 +2510,7 @@ static int commit_one_file(BDRVVVFATState* s,
      uint32_t first_cluster = c;
      mapping_t* mapping = find_mapping_for_cluster(s, c);
      uint32_t size = filesize_of_direntry(direntry);
-    char* cluster = g_malloc(s->cluster_size);
+    char *cluster;
      uint32_t i;
      int fd = 0;
 

@@ -2528,17 +2528,17 @@ static int commit_one_file(BDRVVVFATState* s,
      if (fd < 0) {
          fprintf(stderr, "Could not open %s... (%s, %d)\n", mapping->path,
                  strerror(errno), errno);
-        g_free(cluster);
          return fd;
      }
      if (offset > 0) {
          if (lseek(fd, offset, SEEK_SET) != offset) {
              qemu_close(fd);
-            g_free(cluster);
              return -3;
          }
      }
 
+    cluster = g_malloc(s->cluster_size);
+
      while (offset < size) {
          uint32_t c1;
          int rest_size = (size - offset > s->cluster_size ?
Reviewed-by on v1 1/1
#2 lore raw
In reply to Kevin Wolf
Quoted 5 lines · Kevin Wolf

Don't leak 'cluster' in the mapping == NULL case. Found by Coverity (CID 1055918).

Fixes 8d9401c2791ee2d2805b741b1ee3006041edcd3e
Signed-off-by Kevin Wolf <[email protected]>
Reviewed-by Liam Merwick <[email protected]>

Thanks.

Quoted 38 lines
---
  block/vvfat.c | 6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)
block/vvfat.c +3 -3
index 1de5de1db4..b7b61ea8b7 100644
@@ -2510,7 +2510,7 @@ static int commit_one_file(BDRVVVFATState* s,
      uint32_t first_cluster = c;
      mapping_t* mapping = find_mapping_for_cluster(s, c);
      uint32_t size = filesize_of_direntry(direntry);
-    char* cluster = g_malloc(s->cluster_size);
+    char *cluster;
      uint32_t i;
      int fd = 0;
 

@@ -2528,17 +2528,17 @@ static int commit_one_file(BDRVVVFATState* s,
      if (fd < 0) {
          fprintf(stderr, "Could not open %s... (%s, %d)\n", mapping->path,
                  strerror(errno), errno);
-        g_free(cluster);
          return fd;
      }
      if (offset > 0) {
          if (lseek(fd, offset, SEEK_SET) != offset) {
              qemu_close(fd);
-            g_free(cluster);
              return -3;
          }
      }
 
+    cluster = g_malloc(s->cluster_size);
+
      while (offset < size) {
          uint32_t c1;
          int rest_size = (size - offset > s->cluster_size ?