0007-iso9660-Don-t-leak-memory-on-realloc-failures.patch 2.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172
  1. From e0dd17a3ce79c6622dc78c96e1f2ef1b20e2bf7b Mon Sep 17 00:00:00 2001
  2. From: Peter Jones <pjones@redhat.com>
  3. Date: Sat, 4 Jul 2020 12:25:09 -0400
  4. Subject: [PATCH] iso9660: Don't leak memory on realloc() failures
  5. MIME-Version: 1.0
  6. Content-Type: text/plain; charset=UTF-8
  7. Content-Transfer-Encoding: 8bit
  8. Signed-off-by: Peter Jones <pjones@redhat.com>
  9. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  10. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  11. ---
  12. grub-core/fs/iso9660.c | 24 ++++++++++++++++++++----
  13. 1 file changed, 20 insertions(+), 4 deletions(-)
  14. diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c
  15. index 7ba5b300b..5ec4433b8 100644
  16. --- a/grub-core/fs/iso9660.c
  17. +++ b/grub-core/fs/iso9660.c
  18. @@ -533,14 +533,20 @@ add_part (struct iterate_dir_ctx *ctx,
  19. {
  20. int size = ctx->symlink ? grub_strlen (ctx->symlink) : 0;
  21. grub_size_t sz;
  22. + char *new;
  23. if (grub_add (size, len2, &sz) ||
  24. grub_add (sz, 1, &sz))
  25. return;
  26. - ctx->symlink = grub_realloc (ctx->symlink, sz);
  27. - if (! ctx->symlink)
  28. - return;
  29. + new = grub_realloc (ctx->symlink, sz);
  30. + if (!new)
  31. + {
  32. + grub_free (ctx->symlink);
  33. + ctx->symlink = NULL;
  34. + return;
  35. + }
  36. + ctx->symlink = new;
  37. grub_memcpy (ctx->symlink + size, part, len2);
  38. ctx->symlink[size + len2] = 0;
  39. @@ -634,7 +640,12 @@ susp_iterate_dir (struct grub_iso9660_susp_entry *entry,
  40. is the length. Both are part of the `Component
  41. Record'. */
  42. if (ctx->symlink && !ctx->was_continue)
  43. - add_part (ctx, "/", 1);
  44. + {
  45. + add_part (ctx, "/", 1);
  46. + if (grub_errno)
  47. + return grub_errno;
  48. + }
  49. +
  50. add_part (ctx, (char *) &entry->data[pos + 2],
  51. entry->data[pos + 1]);
  52. ctx->was_continue = (entry->data[pos] & 1);
  53. @@ -653,6 +664,11 @@ susp_iterate_dir (struct grub_iso9660_susp_entry *entry,
  54. add_part (ctx, "/", 1);
  55. break;
  56. }
  57. +
  58. + /* Check if grub_realloc() failed in add_part(). */
  59. + if (grub_errno)
  60. + return grub_errno;
  61. +
  62. /* In pos + 1 the length of the `Component Record' is
  63. stored. */
  64. pos += entry->data[pos + 1] + 2;
  65. --
  66. 2.26.2