|
From: | Stefan Weil |
Subject: | Re: [Qemu-devel] [PATCH] bsd_user: Fix potential null pointer dereference |
Date: | Mon, 21 Nov 2011 21:13:31 +0100 |
User-agent: | Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.23) Gecko/20110921 Thunderbird/3.1.15 |
Am 21.11.2011 20:49, schrieb Peter Maydell:
On 21 November 2011 19:41, Stefan Weil<address@hidden> wrote:This bug was spotted by cppcheck. Using g_try_malloc0 (as does the linux-user code) fixes this. Signed-off-by: Stefan Weil<address@hidden>Oh look, another bug in bsd-user it wouldn't have if it shared code with linux-user :-)
I had read your previous mail and was waiting for your comment when I sent my patch :-) Nobody would mind if Linux and BSD shared more code. So somebody simply has to do the necessary changes.
bsd-user/elfload.c | 5 ++--- 1 files changed, 2 insertions(+), 3 deletions(-) diff --git a/bsd-user/elfload.c b/bsd-user/elfload.c index 1ef1f97..1288884 100644 --- a/bsd-user/elfload.c +++ b/bsd-user/elfload.c @@ -641,8 +641,7 @@ static abi_ulong copy_elf_strings(int argc,char ** argv, void **page, offset = p % TARGET_PAGE_SIZE; pag = (char *)page[p/TARGET_PAGE_SIZE]; if (!pag) { - pag = (char *)malloc(TARGET_PAGE_SIZE); - memset(pag, 0, TARGET_PAGE_SIZE); + pag = g_try_malloc0(TARGET_PAGE_SIZE); page[p/TARGET_PAGE_SIZE] = pag; if (!pag) return 0; @@ -696,7 +695,7 @@ static abi_ulong setup_arg_pages(abi_ulong p, struct linux_binprm *bprm, info->rss++; /* FIXME - check return value of memcpy_to_target() for failure */ memcpy_to_target(stack_base, bprm->page[i], TARGET_PAGE_SIZE); - free(bprm->page[i]); + g_free(bprm->page[i]); } stack_base += TARGET_PAGE_SIZE; }You've missed the s/free/g_free/ in bsd-user/bsdload.c. Compare commit 7dd47667b. -- PMM
I fixed this in new patch, thank you. Regards, Stefan Weil
[Prev in Thread] | Current Thread | [Next in Thread] |