sam460ex: Correct use after free error

[Qemu-devel] [PATCH for 3.0] sam460ex: Correct use after free error

Posted by BALATON Zoltan 7 years, 3 months ago

Commit 51b0d834c changed error handling to report file name in error
message but forgot to move freeing it after usage. Noticed by Coverity.

Fixes: CID 1394217
Reported-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
---
 hw/ppc/sam460ex.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c
index e2b7028..0999efc 100644
--- a/hw/ppc/sam460ex.c
+++ b/hw/ppc/sam460ex.c
@@ -269,11 +269,12 @@ static int sam460ex_load_device_tree(hwaddr addr,
         exit(1);
     }
     fdt = load_device_tree(filename, &fdt_size);
-    g_free(filename);
     if (!fdt) {
         error_report("Couldn't load dtb file `%s'", filename);
+        g_free(filename);
         exit(1);
     }
+    g_free(filename);
 
     /* Manipulate device tree in memory. */
 
-- 
2.7.6

Re: [Qemu-devel] [PATCH for 3.0] sam460ex: Correct use after free error

Posted by Philippe Mathieu-Daudé 7 years, 3 months ago

On 07/15/2018 05:47 PM, BALATON Zoltan wrote:
> Commit 51b0d834c changed error handling to report file name in error
> message but forgot to move freeing it after usage. Noticed by Coverity.
> 
> Fixes: CID 1394217
> Reported-by: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

> ---
>  hw/ppc/sam460ex.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c
> index e2b7028..0999efc 100644
> --- a/hw/ppc/sam460ex.c
> +++ b/hw/ppc/sam460ex.c
> @@ -269,11 +269,12 @@ static int sam460ex_load_device_tree(hwaddr addr,
>          exit(1);
>      }
>      fdt = load_device_tree(filename, &fdt_size);
> -    g_free(filename);
>      if (!fdt) {
>          error_report("Couldn't load dtb file `%s'", filename);
> +        g_free(filename);
>          exit(1);
>      }
> +    g_free(filename);
>  
>      /* Manipulate device tree in memory. */
>  
>

Re: [Qemu-devel] [PATCH for 3.0] sam460ex: Correct use after free error

Posted by David Gibson 7 years, 3 months ago

On Sun, Jul 15, 2018 at 10:47:26PM +0200, BALATON Zoltan wrote:
> Commit 51b0d834c changed error handling to report file name in error
> message but forgot to move freeing it after usage. Noticed by Coverity.
> 
> Fixes: CID 1394217
> Reported-by: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>

Applied to ppc-for-3.0, thanks.

> ---
>  hw/ppc/sam460ex.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c
> index e2b7028..0999efc 100644
> --- a/hw/ppc/sam460ex.c
> +++ b/hw/ppc/sam460ex.c
> @@ -269,11 +269,12 @@ static int sam460ex_load_device_tree(hwaddr addr,
>          exit(1);
>      }
>      fdt = load_device_tree(filename, &fdt_size);
> -    g_free(filename);
>      if (!fdt) {
>          error_report("Couldn't load dtb file `%s'", filename);
> +        g_free(filename);
>          exit(1);
>      }
> +    g_free(filename);
>  
>      /* Manipulate device tree in memory. */
>  

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson