From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 27436 invoked by alias); 2 Jul 2009 11:05:57 -0000 Received: (qmail 27430 invoked by alias); 2 Jul 2009 11:05:57 -0000 X-SWARE-Spam-Status: No, hits=-1.8 required=5.0 tests=AWL,BAYES_00,J_CHICKENPOX_35,J_CHICKENPOX_66,SPF_HELO_PASS X-Spam-Status: No, hits=-1.8 required=5.0 tests=AWL,BAYES_00,J_CHICKENPOX_35,J_CHICKENPOX_66,SPF_HELO_PASS X-Spam-Check-By: sourceware.org X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on bastion2.fedora.phx.redhat.com Subject: gfs2-utils: master - hexedit: avoid NULL dereference upon failed malloc To: cluster-cvs-relay@redhat.com X-Project: Cluster Project X-Git-Module: gfs2-utils.git X-Git-Refname: refs/heads/master X-Git-Reftype: branch X-Git-Oldrev: c1309888b4824577cc334f3fcdb2b9bbcbe4a84b X-Git-Newrev: 3b256287f994e564ec7a6c580003d77029a246bf From: Jim Meyering Message-Id: <20090702110528.EF3261201C1@lists.fedorahosted.org> Date: Thu, 02 Jul 2009 11:05:00 -0000 X-Scanned-By: MIMEDefang 2.58 on 172.16.52.254 Mailing-List: contact cluster-cvs-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Post: List-Help: , Sender: cluster-cvs-owner@sourceware.org X-SW-Source: 2009-q3/txt/msg00010.txt.bz2 Gitweb: http://git.fedorahosted.org/git/gfs2-utils.git?p=gfs2-utils.git;a=commitdiff;h=3b256287f994e564ec7a6c580003d77029a246bf Commit: 3b256287f994e564ec7a6c580003d77029a246bf Parent: c1309888b4824577cc334f3fcdb2b9bbcbe4a84b Author: Jim Meyering AuthorDate: Wed Jun 17 16:54:03 2009 +0200 Committer: Jim Meyering CommitterDate: Thu Jul 2 13:04:05 2009 +0200 hexedit: avoid NULL dereference upon failed malloc * gfs2/edit/hexedit.c (display_indirect): Avoid unchecked malloc by declaring more_indir on the stack. --- gfs2/edit/hexedit.c | 14 ++++++-------- 1 files changed, 6 insertions(+), 8 deletions(-) diff --git a/gfs2/edit/hexedit.c b/gfs2/edit/hexedit.c index f9b9bb4..5c66995 100644 --- a/gfs2/edit/hexedit.c +++ b/gfs2/edit/hexedit.c @@ -1416,13 +1416,12 @@ static int display_indirect(struct iinfo *ind, int indblocks, int level, uint64_ file_offset = 0; if (!termlines && ((level + 1 < di.di_height) || (S_ISDIR(di.di_mode) && !level))) { - struct iinfo *more_indir; int more_ind; char *tmpbuf; - more_indir = malloc(sizeof(struct iinfo)); tmpbuf = malloc(sbd.bsize); if (tmpbuf) { + struct iinfo more_indir; lseek(sbd.device_fd, ind->ii[pndx].block * sbd.bsize, SEEK_SET); @@ -1437,20 +1436,19 @@ static int display_indirect(struct iinfo *ind, int indblocks, int level, uint64_ (unsigned long long)ind->ii[pndx].block); exit(-1); } - memset(more_indir, 0, sizeof(struct iinfo)); + memset(&more_indir, 0, sizeof(struct iinfo)); if (S_ISDIR(di.di_mode)) { - do_leaf_extended(tmpbuf, more_indir); - display_leaf(more_indir); + do_leaf_extended(tmpbuf, &more_indir); + display_leaf(&more_indir); } else { more_ind = do_indirect_extended(tmpbuf, - more_indir); - display_indirect(more_indir, + &more_indir); + display_indirect(&more_indir, more_ind, level + 1, file_offset); } free(tmpbuf); } - free(more_indir); } print_entry_ndx = pndx; /* restore after recursion */ eol(0);