don't dereference NULL upon failed realloc

PATCH New Jim Meyering 1 participant 1 message Oct 13, 2008

Share & tools

Jim Meyering

author

2008-10-13 14:10 UTC #0 lore raw

PATCH 1/1 don't dereference NULL upon failed realloc

* gfs/tests/filecon2/filecon2_server.c (main): Fix typo (s/sock/ssin/) that would make a failed realloc cause a NULL dereference.
* gnbd/tools/gnbd_export/gnbd_export.c (execute_uid_program):
Diagnose a failed realloc.
* group/dlm_controld/deadlock.c (add_waitfor): Handle failed realloc.
---

Hello,

I did a quick audit for uses of realloc and found a few cases in which failure could lead to a NULL dereference. This patch fixes those. Obviously, I didn't know quite what (if anything) you'd want to write to the log when deadlock.c's add_waitfor fails, so I left that as "...".

Jim

 gfs/tests/filecon2/filecon2_server.c |    2 +-
 gnbd/tools/gnbd_export/gnbd_export.c |    4 ++++
 group/dlm_controld/deadlock.c        |   10 ++++++++--
 3 files changed, 13 insertions(+), 3 deletions(-)

gfs/tests/filecon2/filecon2_server.c +1 -1

index 904039e..bc59124 100644
@@ -555,7 +555,7 @@ int main(int argc, char *argv[])
       if (!sock)
 	die("can't alloc memory: %s\n", strerror(errno));
       ssin = realloc(ssin, clients * sizeof(struct sockaddr_in));
-      if (!sock)
+      if (!ssin)
 	die("can't alloc memory: %s\n", strerror(errno));
 
       size = sizeof(struct sockaddr_in);

gnbd/tools/gnbd_export/gnbd_export.c +4 -0

index 1e4be29..50a805d 100644
@@ -488,6 +488,10 @@ char *execute_uid_program(char *command){
       delim = "'";
     }
     argv = realloc(argv, (size + 2) * sizeof(char **));
+    if (!argv){
+      printe("cannot allocate memory for command line\n");
+      exit(1);
+    }
     argv[size++] = ptr;
     ptr = strpbrk(ptr, delim);
     if (!ptr){

group/dlm_controld/deadlock.c +8 -2

index eecd8a5..46644af 100644
@@ -1334,10 +1334,16 @@ static void add_waitfor(struct lockspace *ls, struct dlm_lkb *waiting_lkb,
 	}
 
 	if (tr->waitfor_count == tr->waitfor_alloc) {
+		struct trans **new_waitfor;
 		old_alloc = tr->waitfor_alloc;
 		tr->waitfor_alloc += TR_NALLOC;
-		tr->waitfor = realloc(tr->waitfor,
-				      tr->waitfor_alloc * sizeof(tr));
+		new_waitfor = realloc(tr->waitfor,
+				      tr->waitfor_alloc * sizeof(*tr->waitfor));
+		if (new_waitfor == NULL) {
+			free(tr->waitfor);
+			log_group(ls, "failed to allocate ...");
+			return;
+		}
 		for (i = old_alloc; i < tr->waitfor_alloc; i++)
 			tr->waitfor[i] = NULL;
 	}

--
1.6.0.2.514.g23abd3