colin/u-boot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fs/squashfs: avoid illegal free() in sqfs_opendir()

Browse Source 
* Use calloc() to allocate token_list. This avoids an illegal free if
  sqfs_tokenize() fails.
* Do not iterate over token_list if it has not been allocated.

Addresses-Coverity-ID: 510453:  Null pointer dereferences  (FORWARD_NULL)
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Joao Marcos Costa <joaomarcos.costa@bootlin.com>
Reviewed-by: Joao Marcos Costa <jmcosta944@gmail.com>
This commit is contained in:
Heinrich Schuchardt
2025-04-14 15:19:24 +02:00
committed by Tom Rini
parent 3e6bbc5adc
commit 185fdf5e94
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
fs/squashfs/sqfs.c
View File

@@ -949,7 +949,7 @@ static int sqfs_opendir_nest(const char *filename, struct fs_dir_stream **dirsp)
goto out;
}
token_list = malloc(token_count * sizeof(char *));
token_list = calloc(token_count, sizeof(char *));
if (!token_list) {
ret = -EINVAL;
goto out;
@@ -987,9 +987,11 @@ static int sqfs_opendir_nest(const char *filename, struct fs_dir_stream **dirsp)
*dirsp = (struct fs_dir_stream *)dirs;
out:
for (j = 0; j < token_count; j++)
free(token_list[j]);
free(token_list);
if (token_list) {
for (j = 0; j < token_count; j++)
free(token_list[j]);
free(token_list);
}
free(pos_list);
free(path);
if (ret) {