aboutsummaryrefslogtreecommitdiff
path: root/fs
diff options
context:
space:
mode:
authorRichard Genoud <richard.genoud@posteo.net>2020-11-03 12:11:17 +0100
committerTom Rini <trini@konsulko.com>2020-11-19 09:45:49 -0500
commit33686804d29e676177d408f1ce047b8c35185ddb (patch)
treef4692bb5864688622c0f55c390cdb0f6892b0ddf /fs
parent53db0e24a8f981c1e303a1c745b8f0e28544096f (diff)
downloadu-boot-33686804d29e676177d408f1ce047b8c35185ddb.zip
u-boot-33686804d29e676177d408f1ce047b8c35185ddb.tar.gz
u-boot-33686804d29e676177d408f1ce047b8c35185ddb.tar.bz2
fs/squashfs: sqfs_get_abs_path: fix possible memory leak on error
if sqfs_tokenize(rel_tokens, rc, rel); fails, the function exits without freeing the array base_tokens. Reviewed-by: Joao Marcos Costa <jmcosta944@gmail.com> Signed-off-by: Richard Genoud <richard.genoud@posteo.net>
Diffstat (limited to 'fs')
-rw-r--r--fs/squashfs/sqfs.c32
1 files changed, 18 insertions, 14 deletions
diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
index 825d5d1..f41deec 100644
--- a/fs/squashfs/sqfs.c
+++ b/fs/squashfs/sqfs.c
@@ -340,28 +340,31 @@ static char *sqfs_get_abs_path(const char *base, const char *rel)
char **base_tokens, **rel_tokens, *resolved = NULL;
int ret, bc, rc, i, updir = 0, resolved_size = 0, offset = 0;
+ base_tokens = NULL;
+ rel_tokens = NULL;
+
/* Memory allocation for the token lists */
bc = sqfs_count_tokens(base);
rc = sqfs_count_tokens(rel);
if (bc < 1 || rc < 1)
return NULL;
- base_tokens = malloc(bc * sizeof(char *));
+ base_tokens = calloc(bc, sizeof(char *));
if (!base_tokens)
return NULL;
- rel_tokens = malloc(rc * sizeof(char *));
+ rel_tokens = calloc(rc, sizeof(char *));
if (!rel_tokens)
- goto free_b_tokens;
+ goto out;
/* Fill token lists */
ret = sqfs_tokenize(base_tokens, bc, base);
if (ret)
- goto free_r_tokens;
+ goto out;
ret = sqfs_tokenize(rel_tokens, rc, rel);
if (ret)
- goto free_r_tokens;
+ goto out;
/* count '..' occurrences in target path */
for (i = 0; i < rc; i++) {
@@ -372,7 +375,7 @@ static char *sqfs_get_abs_path(const char *base, const char *rel)
/* Remove the last token and the '..' occurrences */
bc = sqfs_clean_base_path(base_tokens, bc, updir);
if (bc < 0)
- goto free_r_tokens;
+ goto out;
/* Calculate resolved path size */
if (!bc)
@@ -383,7 +386,7 @@ static char *sqfs_get_abs_path(const char *base, const char *rel)
resolved = malloc(resolved_size + 1);
if (!resolved)
- goto free_r_tokens_loop;
+ goto out;
/* Set resolved path */
memset(resolved, '\0', resolved_size + 1);
@@ -391,14 +394,15 @@ static char *sqfs_get_abs_path(const char *base, const char *rel)
resolved[offset++] = '/';
offset += sqfs_join(rel_tokens, resolved + offset, updir, rc, '/');
-free_r_tokens_loop:
- for (i = 0; i < rc; i++)
- free(rel_tokens[i]);
- for (i = 0; i < bc; i++)
- free(base_tokens[i]);
-free_r_tokens:
+out:
+ if (rel_tokens)
+ for (i = 0; i < rc; i++)
+ free(rel_tokens[i]);
+ if (base_tokens)
+ for (i = 0; i < bc; i++)
+ free(base_tokens[i]);
+
free(rel_tokens);
-free_b_tokens:
free(base_tokens);
return resolved;