0072-affs-Fix-memory-leaks.patch 2.4 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283
  1. From 178ac5107389f8e5b32489d743d6824a5ebf342a Mon Sep 17 00:00:00 2001
  2. From: Darren Kenny <darren.kenny@oracle.com>
  3. Date: Thu, 26 Nov 2020 12:48:07 +0000
  4. Subject: [PATCH] affs: Fix memory leaks
  5. The node structure reference is being allocated but not freed if it
  6. reaches the end of the function. If any of the hooks had returned
  7. a non-zero value, then node would have been copied in to the context
  8. reference, but otherwise node is not stored and should be freed.
  9. Similarly, the call to grub_affs_create_node() replaces the allocated
  10. memory in node with a newly allocated structure, leaking the existing
  11. memory pointed by node.
  12. Finally, when dir->parent is set, then we again replace node with newly
  13. allocated memory, which seems unnecessary when we copy in the values
  14. from dir->parent immediately after.
  15. Fixes: CID 73759
  16. Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
  17. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  18. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  19. ---
  20. grub-core/fs/affs.c | 18 ++++++++----------
  21. 1 file changed, 8 insertions(+), 10 deletions(-)
  22. diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c
  23. index 220b371..230e26a 100644
  24. --- a/grub-core/fs/affs.c
  25. +++ b/grub-core/fs/affs.c
  26. @@ -400,12 +400,12 @@ grub_affs_iterate_dir (grub_fshelp_node_t dir,
  27. {
  28. unsigned int i;
  29. struct grub_affs_file file;
  30. - struct grub_fshelp_node *node = 0;
  31. + struct grub_fshelp_node *node, *orig_node;
  32. struct grub_affs_data *data = dir->data;
  33. grub_uint32_t *hashtable;
  34. /* Create the directory entries for `.' and `..'. */
  35. - node = grub_zalloc (sizeof (*node));
  36. + node = orig_node = grub_zalloc (sizeof (*node));
  37. if (!node)
  38. return 1;
  39. @@ -414,9 +414,6 @@ grub_affs_iterate_dir (grub_fshelp_node_t dir,
  40. return 1;
  41. if (dir->parent)
  42. {
  43. - node = grub_zalloc (sizeof (*node));
  44. - if (!node)
  45. - return 1;
  46. *node = *dir->parent;
  47. if (hook ("..", GRUB_FSHELP_DIR, node, hook_data))
  48. return 1;
  49. @@ -456,17 +453,18 @@ grub_affs_iterate_dir (grub_fshelp_node_t dir,
  50. if (grub_affs_create_node (dir, hook, hook_data, &node, &hashtable,
  51. next, &file))
  52. - return 1;
  53. + {
  54. + /* Node has been replaced in function. */
  55. + grub_free (orig_node);
  56. + return 1;
  57. + }
  58. next = grub_be_to_cpu32 (file.next);
  59. }
  60. }
  61. - grub_free (hashtable);
  62. - return 0;
  63. -
  64. fail:
  65. - grub_free (node);
  66. + grub_free (orig_node);
  67. grub_free (hashtable);
  68. return 0;
  69. }
  70. --
  71. 2.14.2