From 6afafa86f3446f5e6dd410cc2c442e98adabc26c Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Mon, 17 Feb 2014 18:55:31 +0000 Subject: linux-user/elfload.c: Avoid calling g_free() on uninitialized data Avoid calling g_free() on unintialized data in the error-handling paths in elf_core_dump() by splitting the initialization of the elf_note_info struct out of fill_note_info() so that it's always valid to call free_note_info() whether we got to the point of being able to fill_note_info() or not. Signed-off-by: Peter Maydell Signed-off-by: Riku Voipio --- linux-user/elfload.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) (limited to 'linux-user') diff --git a/linux-user/elfload.c b/linux-user/elfload.c index 5902f16..c0687e3 100644 --- a/linux-user/elfload.c +++ b/linux-user/elfload.c @@ -2636,6 +2636,16 @@ static void fill_thread_info(struct elf_note_info *info, const CPUArchState *env info->notes_size += note_size(&ets->notes[0]); } +static void init_note_info(struct elf_note_info *info) +{ + /* Initialize the elf_note_info structure so that it is at + * least safe to call free_note_info() on it. Must be + * called before calling fill_note_info(). + */ + memset(info, 0, sizeof (*info)); + QTAILQ_INIT(&info->thread_list); +} + static int fill_note_info(struct elf_note_info *info, long signr, const CPUArchState *env) { @@ -2644,10 +2654,6 @@ static int fill_note_info(struct elf_note_info *info, TaskState *ts = (TaskState *)env->opaque; int i; - (void) memset(info, 0, sizeof (*info)); - - QTAILQ_INIT(&info->thread_list); - info->notes = g_malloc0(NUMNOTES * sizeof (struct memelfnote)); if (info->notes == NULL) return (-ENOMEM); @@ -2781,6 +2787,8 @@ static int elf_core_dump(int signr, const CPUArchState *env) int segs = 0; int fd = -1; + init_note_info(&info); + errno = 0; getrlimit(RLIMIT_CORE, &dumpsize); if (dumpsize.rlim_cur == 0) -- cgit v1.1