0010-xnu-Fix-double-free-in-grub_xnu_devprop_add_property.patch 1.8 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758
  1. From dc9777dc17697b196c415c53187a55861d41fd2a Mon Sep 17 00:00:00 2001
  2. From: Alexey Makhalov <amakhalov@vmware.com>
  3. Date: Wed, 8 Jul 2020 21:30:43 +0000
  4. Subject: [PATCH] xnu: Fix double free in grub_xnu_devprop_add_property()
  5. MIME-Version: 1.0
  6. Content-Type: text/plain; charset=UTF-8
  7. Content-Transfer-Encoding: 8bit
  8. grub_xnu_devprop_add_property() should not free utf8 and utf16 as it get
  9. allocated and freed in the caller.
  10. Minor improvement: do prop fields initialization after memory allocations.
  11. Fixes: CID 292442, CID 292457, CID 292460, CID 292466
  12. Signed-off-by: Alexey Makhalov <amakhalov@vmware.com>
  13. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  14. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  15. ---
  16. grub-core/loader/i386/xnu.c | 17 ++++++++---------
  17. 1 file changed, 8 insertions(+), 9 deletions(-)
  18. diff --git a/grub-core/loader/i386/xnu.c b/grub-core/loader/i386/xnu.c
  19. index b7d176b5d..e9e119259 100644
  20. --- a/grub-core/loader/i386/xnu.c
  21. +++ b/grub-core/loader/i386/xnu.c
  22. @@ -262,20 +262,19 @@ grub_xnu_devprop_add_property (struct grub_xnu_devprop_device_descriptor *dev,
  23. if (!prop)
  24. return grub_errno;
  25. - prop->name = utf8;
  26. - prop->name16 = utf16;
  27. - prop->name16len = utf16len;
  28. -
  29. - prop->length = datalen;
  30. - prop->data = grub_malloc (prop->length);
  31. + prop->data = grub_malloc (datalen);
  32. if (!prop->data)
  33. {
  34. - grub_free (prop->name);
  35. - grub_free (prop->name16);
  36. grub_free (prop);
  37. return grub_errno;
  38. }
  39. - grub_memcpy (prop->data, data, prop->length);
  40. + grub_memcpy (prop->data, data, datalen);
  41. +
  42. + prop->name = utf8;
  43. + prop->name16 = utf16;
  44. + prop->name16len = utf16len;
  45. + prop->length = datalen;
  46. +
  47. grub_list_push (GRUB_AS_LIST_P (&dev->properties),
  48. GRUB_AS_LIST (prop));
  49. return GRUB_ERR_NONE;
  50. --
  51. 2.26.2