[Qemu-devel] [PATCH] block/vvfat: Fix potential memory leaks and other memory errors

[Stefan Weil]

cppcheck reported memory leaks and mismatched g_malloc() with free()
instead of g_free().

Fix these errors.

Cc: Kevin Wolf <address@hidden>
Signed-off-by: Stefan Weil <address@hidden>
---
 block/vvfat.c |   51 ++++++++++++++++++++++++++++++---------------------
 1 files changed, 30 insertions(+), 21 deletions(-)

diff --git a/block/vvfat.c b/block/vvfat.c
index f567c9a..f45939d 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -86,8 +86,7 @@ static inline void array_init(array_t* array,unsigned int 
item_size)
 
 static inline void array_free(array_t* array)
 {
-    if(array->pointer)
-        free(array->pointer);
+    g_free(array->pointer);
     array->size=array->next=0;
 }
 
@@ -169,7 +168,7 @@ static inline int array_roll(array_t* array,int 
index_to,int index_from,int coun
 
     memcpy(to,buf,is*count);
 
-    free(buf);
+    g_free(buf);
 
     return 0;
 }
@@ -732,7 +731,7 @@ static int read_directory(BDRVVVFATState* s, int 
mapping_index)
        snprintf(buffer,length,"%s/%s",dirname,entry->d_name);
 
        if(stat(buffer,&st)<0) {
-           free(buffer);
+            g_free(buffer);
             continue;
        }
 
@@ -755,7 +754,7 @@ static int read_directory(BDRVVVFATState* s, int 
mapping_index)
            direntry->begin=0; /* do that later */
         if (st.st_size > 0x7fffffff) {
            fprintf(stderr, "File %s is larger than 2GB\n", buffer);
-           free(buffer);
+            g_free(buffer);
             closedir(dir);
            return -2;
         }
@@ -1375,7 +1374,7 @@ DLOG(fprintf(stderr, "clear_commits (%d commits)\n", 
s->commits.next));
        assert(commit->path || commit->action == ACTION_WRITEOUT);
        if (commit->action != ACTION_WRITEOUT) {
            assert(commit->path);
-           free(commit->path);
+            g_free(commit->path);
        } else
            assert(commit->path == NULL);
     }
@@ -1782,7 +1781,7 @@ DLOG(fprintf(stderr, "read cluster %d (sector %d)\n", 
(int)cluster_num, (int)clu
        if (subret) {
            fprintf(stderr, "Error fetching direntries\n");
        fail:
-           free(cluster);
+            g_free(cluster);
            return 0;
        }
 
@@ -1850,7 +1849,7 @@ DLOG(fprintf(stderr, "check direntry %d:\n", i); 
print_direntry(direntries + i))
        cluster_num = modified_fat_get(s, cluster_num);
     } while(!fat_eof(s, cluster_num));
 
-    free(cluster);
+    g_free(cluster);
     return ret;
 }
 
@@ -1995,8 +1994,9 @@ static int remove_mapping(BDRVVVFATState* s, int 
mapping_index)
     mapping_t* first_mapping = array_get(&(s->mapping), 0);
 
     /* free mapping */
-    if (mapping->first_mapping_index < 0)
-       free(mapping->path);
+    if (mapping->first_mapping_index < 0) {
+        g_free(mapping->path);
+    }
 
     /* remove from s->mapping */
     array_remove(&(s->mapping), mapping_index);
@@ -2232,11 +2232,15 @@ static int commit_one_file(BDRVVVFATState* s,
     if (fd < 0) {
        fprintf(stderr, "Could not open %s... (%s, %d)\n", mapping->path,
                strerror(errno), errno);
+        g_free(cluster);
        return fd;
     }
-    if (offset > 0)
-       if (lseek(fd, offset, SEEK_SET) != offset)
-           return -3;
+    if (offset > 0) {
+        if (lseek(fd, offset, SEEK_SET) != offset) {
+            g_free(cluster);
+            return -3;
+        }
+    }
 
     while (offset < size) {
        uint32_t c1;
@@ -2252,11 +2256,15 @@ static int commit_one_file(BDRVVVFATState* s,
        ret = vvfat_read(s->bs, cluster2sector(s, c),
            (uint8_t*)cluster, (rest_size + 0x1ff) / 0x200);
 
-       if (ret < 0)
-           return ret;
+        if (ret < 0) {
+            g_free(cluster);
+            return ret;
+        }
 
-       if (write(fd, cluster, rest_size) < 0)
-           return -2;
+        if (write(fd, cluster, rest_size) < 0) {
+            g_free(cluster);
+            return -2;
+        }
 
        offset += rest_size;
        c = c1;
@@ -2265,9 +2273,11 @@ static int commit_one_file(BDRVVVFATState* s,
     if (ftruncate(fd, size)) {
         perror("ftruncate()");
         close(fd);
+        g_free(cluster);
         return -4;
     }
     close(fd);
+    g_free(cluster);
 
     return commit_mappings(s, first_cluster, dir_index);
 }
@@ -2399,7 +2409,7 @@ static int handle_renames_and_mkdirs(BDRVVVFATState* s)
                }
            }
 
-           free(old_path);
+            g_free(old_path);
            array_remove(&(s->commits), i);
            continue;
        } else if (commit->action == ACTION_MKDIR) {
@@ -2775,7 +2785,7 @@ static int write_target_commit(BlockDriverState *bs, 
int64_t sector_num,
 static void write_target_close(BlockDriverState *bs) {
     BDRVVVFATState* s = *((BDRVVVFATState**) bs->opaque);
     bdrv_delete(s->qcow);
-    free(s->qcow_filename);
+    g_free(s->qcow_filename);
 }
 
 static BlockDriver vvfat_write_target = {
@@ -2836,8 +2846,7 @@ static void vvfat_close(BlockDriverState *bs)
     array_free(&(s->fat));
     array_free(&(s->directory));
     array_free(&(s->mapping));
-    if(s->cluster_buffer)
-        free(s->cluster_buffer);
+    g_free(s->cluster_buffer);
 }
 
 static BlockDriver bdrv_vvfat = {
-- 
1.7.2.5