0127-kern-parser-Fix-a-memory-leak.patch 2.2 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677
  1. From c6c426e5ab6ea715153b72584de6bd8c82f698ec Mon Sep 17 00:00:00 2001
  2. From: Chris Coulson <chris.coulson@canonical.com>
  3. Date: Wed, 18 Nov 2020 00:59:24 +0000
  4. Subject: [PATCH] kern/parser: Fix a memory leak
  5. The getline() function supplied to grub_parser_split_cmdline() returns
  6. a newly allocated buffer and can be called multiple times, but the
  7. returned buffer is never freed.
  8. Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
  9. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  10. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  11. ---
  12. grub-core/kern/parser.c | 20 ++++++++++++++++----
  13. 1 file changed, 16 insertions(+), 4 deletions(-)
  14. diff --git a/grub-core/kern/parser.c b/grub-core/kern/parser.c
  15. index d1cf061..39e4df6 100644
  16. --- a/grub-core/kern/parser.c
  17. +++ b/grub-core/kern/parser.c
  18. @@ -140,6 +140,7 @@ grub_parser_split_cmdline (const char *cmdline,
  19. char buffer[1024];
  20. char *bp = buffer;
  21. char *rd = (char *) cmdline;
  22. + char *rp = rd;
  23. char varname[200];
  24. char *vp = varname;
  25. char *args;
  26. @@ -149,10 +150,18 @@ grub_parser_split_cmdline (const char *cmdline,
  27. *argv = NULL;
  28. do
  29. {
  30. - if (!rd || !*rd)
  31. + if (rp == NULL || *rp == '\0')
  32. {
  33. + if (rd != cmdline)
  34. + {
  35. + grub_free (rd);
  36. + rd = rp = NULL;
  37. + }
  38. if (getline)
  39. - getline (&rd, 1, getline_data);
  40. + {
  41. + getline (&rd, 1, getline_data);
  42. + rp = rd;
  43. + }
  44. else
  45. break;
  46. }
  47. @@ -160,12 +169,12 @@ grub_parser_split_cmdline (const char *cmdline,
  48. if (!rd)
  49. break;
  50. - for (; *rd; rd++)
  51. + for (; *rp != '\0'; rp++)
  52. {
  53. grub_parser_state_t newstate;
  54. char use;
  55. - newstate = grub_parser_cmdline_state (state, *rd, &use);
  56. + newstate = grub_parser_cmdline_state (state, *rp, &use);
  57. /* If a variable was being processed and this character does
  58. not describe the variable anymore, write the variable to
  59. @@ -198,6 +207,9 @@ grub_parser_split_cmdline (const char *cmdline,
  60. }
  61. while (state != GRUB_PARSER_STATE_TEXT && !check_varstate (state));
  62. + if (rd != cmdline)
  63. + grub_free (rd);
  64. +
  65. /* A special case for when the last character was part of a
  66. variable. */
  67. add_var (varname, &bp, &vp, state, GRUB_PARSER_STATE_TEXT);
  68. --
  69. 2.14.2