GitHub-Mirror/u-boot
2
0
Fork 0
mirror of https://github.com/Fishwaldo/u-boot.git synced 2025-06-27 09:02:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fs/squashfs: sqfs_opendir: fix some memory leaks and dangling pointers

Browse source 
When trying to load an non-existing file, the cpu hangs!

Signed-off-by: Richard Genoud <richard.genoud@posteo.net>
This commit is contained in:
Richard Genoud 2020-11-03 12:11:00 +01:00 • committed by Tom Rini
parent 1b1e0c0195
commit f268768d43
1 changed files with 29 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

37
fs/squashfs/sqfs.c
View file

@ -821,22 +821,37 @@ int sqfs_opendir(const char *filename, struct fs_dir_stream **dirsp)
if (!dirs) if (!dirs)
return -EINVAL; return -EINVAL;
/* these should be set to NULL to prevent dangling pointers */
dirs->dir_header = NULL;
dirs->entry = NULL;
dirs->table = NULL;
dirs->inode_table = NULL;
dirs->dir_table = NULL;
ret = sqfs_read_inode_table(&inode_table); ret = sqfs_read_inode_table(&inode_table);
if (ret) if (ret) {
return -EINVAL; ret = -EINVAL;
goto free_dirs;
}
metablks_count = sqfs_read_directory_table(&dir_table, &pos_list); metablks_count = sqfs_read_directory_table(&dir_table, &pos_list);
if (metablks_count < 1) if (metablks_count < 1) {
return -EINVAL; ret = -EINVAL;
goto free_inode_table;
}
/* Tokenize filename */ /* Tokenize filename */
token_count = sqfs_count_tokens(filename); token_count = sqfs_count_tokens(filename);
if (token_count < 0) if (token_count < 0) {
return -EINVAL; ret = -EINVAL;
goto free_inode_table;
}
path = strdup(filename); path = strdup(filename);
if (!path) if (!path) {
return -ENOMEM; ret = -EINVAL;
goto free_inode_table;
}
token_list = malloc(token_count * sizeof(char *)); token_list = malloc(token_count * sizeof(char *));
if (!token_list) { if (!token_list) {
@ -882,6 +897,12 @@ free_tokens:
free(pos_list); free(pos_list);
free_path: free_path:
free(path); free(path);
free_inode_table:
if (ret)
free(inode_table);
free_dirs:
if (ret)
free(dirs);
return ret; return ret;
} }