| Message ID | 20180715211731.2EBA27456B1@zero.eik.bme.hu |
|---|---|
| State | New |
| Headers | show |
| Series | [for,3.0] sam460ex: Correct use after free error | expand |
On 07/15/2018 05:47 PM, BALATON Zoltan wrote: > Commit 51b0d834c changed error handling to report file name in error > message but forgot to move freeing it after usage. Noticed by Coverity. > > Fixes: CID 1394217 > Reported-by: Paolo Bonzini <pbonzini@redhat.com> > Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> > --- > hw/ppc/sam460ex.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c > index e2b7028..0999efc 100644 > --- a/hw/ppc/sam460ex.c > +++ b/hw/ppc/sam460ex.c > @@ -269,11 +269,12 @@ static int sam460ex_load_device_tree(hwaddr addr, > exit(1); > } > fdt = load_device_tree(filename, &fdt_size); > - g_free(filename); > if (!fdt) { > error_report("Couldn't load dtb file `%s'", filename); > + g_free(filename); > exit(1); > } > + g_free(filename); > > /* Manipulate device tree in memory. */ > >
On Sun, Jul 15, 2018 at 10:47:26PM +0200, BALATON Zoltan wrote: > Commit 51b0d834c changed error handling to report file name in error > message but forgot to move freeing it after usage. Noticed by Coverity. > > Fixes: CID 1394217 > Reported-by: Paolo Bonzini <pbonzini@redhat.com> > Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> Applied to ppc-for-3.0, thanks. > --- > hw/ppc/sam460ex.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c > index e2b7028..0999efc 100644 > --- a/hw/ppc/sam460ex.c > +++ b/hw/ppc/sam460ex.c > @@ -269,11 +269,12 @@ static int sam460ex_load_device_tree(hwaddr addr, > exit(1); > } > fdt = load_device_tree(filename, &fdt_size); > - g_free(filename); > if (!fdt) { > error_report("Couldn't load dtb file `%s'", filename); > + g_free(filename); > exit(1); > } > + g_free(filename); > > /* Manipulate device tree in memory. */ >
diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c index e2b7028..0999efc 100644 --- a/hw/ppc/sam460ex.c +++ b/hw/ppc/sam460ex.c @@ -269,11 +269,12 @@ static int sam460ex_load_device_tree(hwaddr addr, exit(1); } fdt = load_device_tree(filename, &fdt_size); - g_free(filename); if (!fdt) { error_report("Couldn't load dtb file `%s'", filename); + g_free(filename); exit(1); } + g_free(filename); /* Manipulate device tree in memory. */
Commit 51b0d834c changed error handling to report file name in error message but forgot to move freeing it after usage. Noticed by Coverity. Fixes: CID 1394217 Reported-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu> --- hw/ppc/sam460ex.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)