lib: fwts_gpe: fix double free on gpe buffer

Submitted by Colin King on April 21, 2017, 9:24 a.m.

Details

Message ID 20170421092451.8454-1-colin.king@canonical.com
State New
Headers show

Commit Message

Colin King April 21, 2017, 9:24 a.m.
From: Colin Ian King <colin.king@canonical.com>

My previous memory leak fix introduced a double free bug, fix this by
not free'ing the buffer twice.  Issue detected by CoverityScan.

Fixes: 5a4034ff7938 ("lib: fwts_gpe: free original gpe buffer on failed realloc")

Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 src/lib/src/fwts_gpe.c | 1 -
 1 file changed, 1 deletion(-)

Comments

Alex Hung April 22, 2017, 3 p.m.
On 2017-04-21 02:24 AM, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> My previous memory leak fix introduced a double free bug, fix this by
> not free'ing the buffer twice.  Issue detected by CoverityScan.
>
> Fixes: 5a4034ff7938 ("lib: fwts_gpe: free original gpe buffer on failed realloc")
>
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> ---
>  src/lib/src/fwts_gpe.c | 1 -
>  1 file changed, 1 deletion(-)
>
> diff --git a/src/lib/src/fwts_gpe.c b/src/lib/src/fwts_gpe.c
> index a16fee86..2b3db0f5 100644
> --- a/src/lib/src/fwts_gpe.c
> +++ b/src/lib/src/fwts_gpe.c
> @@ -66,7 +66,6 @@ int fwts_gpe_read(fwts_gpe **gpes)
>
>  			tmp = realloc(*gpes, sizeof(fwts_gpe) * (n+1));
>  			if (!tmp) {
> -				free(*gpes);
>  				goto error;
>  			} else {
>  				char path[PATH_MAX];
>

Acked-by: Alex Hung <alex.hung@canonical.com>

Patch hide | download patch | download mbox

diff --git a/src/lib/src/fwts_gpe.c b/src/lib/src/fwts_gpe.c
index a16fee86..2b3db0f5 100644
--- a/src/lib/src/fwts_gpe.c
+++ b/src/lib/src/fwts_gpe.c
@@ -66,7 +66,6 @@  int fwts_gpe_read(fwts_gpe **gpes)
 
 			tmp = realloc(*gpes, sizeof(fwts_gpe) * (n+1));
 			if (!tmp) {
-				free(*gpes);
 				goto error;
 			} else {
 				char path[PATH_MAX];