gfs2-utils: master - Revert "hexedit: avoid NULL dereference upon failed malloc"

[Jim Meyering <meyering@fedoraproject.org>]

Gitweb:        http://git.fedorahosted.org/git/gfs2-utils.git?p=gfs2-utils.git;a=commitdiff;h=1997a38b4d48b9fcd1603e8d1024a9d9608d8cd1
Commit:        1997a38b4d48b9fcd1603e8d1024a9d9608d8cd1
Parent:        3f7281325f8ebafe34fdc3edc96ef1f8d0c18cc1
Author:        Jim Meyering <meyering@redhat.com>
AuthorDate:    Wed Sep 2 16:40:32 2009 +0200
Committer:     Jim Meyering <meyering@redhat.com>
CommitterDate: Wed Sep 2 16:40:32 2009 +0200

Revert "hexedit: avoid NULL dereference upon failed malloc"

Bob Peterson noticed that the change we're reverting here,
commit 3b256287f994e564ec7a6c580003d77029a246bf,
seemed to be the cause of a segfault.  He pointed out that
the buffer moved from 'malloc'd to stack currently occupies
about 10MB(!).  It's obviously better not to put something
that large on the stack.
---
 gfs2/edit/hexedit.c |   14 ++++++++------
 1 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/gfs2/edit/hexedit.c b/gfs2/edit/hexedit.c
index 2192e8d..684fc05 100644
--- a/gfs2/edit/hexedit.c
+++ b/gfs2/edit/hexedit.c
@@ -1433,12 +1433,13 @@ static int display_indirect(struct iinfo *ind, int indblocks, int level, uint64_
 			file_offset = 0;
 		if (!termlines && ((level + 1 < di.di_height) ||
 				   (S_ISDIR(di.di_mode) && !level))) {
+			struct iinfo *more_indir;
 			int more_ind;
 			char *tmpbuf;
 			
+			more_indir = malloc(sizeof(struct iinfo));
 			tmpbuf = malloc(sbd.bsize);
 			if (tmpbuf) {
-				struct iinfo more_indir;
 				lseek(sbd.device_fd,
 				      ind->ii[pndx].block * sbd.bsize,
 				      SEEK_SET);
@@ -1453,19 +1454,20 @@ static int display_indirect(struct iinfo *ind, int indblocks, int level, uint64_
 						(unsigned long long)ind->ii[pndx].block);
 					exit(-1);
 				}
-				memset(&more_indir, 0, sizeof(struct iinfo));
+				memset(more_indir, 0, sizeof(struct iinfo));
 				if (S_ISDIR(di.di_mode)) {
-					do_leaf_extended(tmpbuf, &more_indir);
-					display_leaf(&more_indir);
+					do_leaf_extended(tmpbuf, more_indir);
+					display_leaf(more_indir);
 				} else {
 					more_ind = do_indirect_extended(tmpbuf,
-									&more_indir);
-					display_indirect(&more_indir,
+									more_indir);
+					display_indirect(more_indir,
 							 more_ind, level + 1,
 							 file_offset);
 				}
 				free(tmpbuf);
 			}
+			free(more_indir);
 		}
 		print_entry_ndx = pndx; /* restore after recursion */
 		eol(0);