From patchwork Wed Oct 7 14:19:29 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Tom Rini X-Patchwork-Id: 527306 X-Patchwork-Delegate: trini@ti.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from theia.denx.de (theia.denx.de [85.214.87.163]) by ozlabs.org (Postfix) with ESMTP id 763DF140D89 for ; Thu, 8 Oct 2015 01:19:36 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id 7BF064B7CC; Wed, 7 Oct 2015 16:19:34 +0200 (CEST) Received: from theia.denx.de ([127.0.0.1]) by localhost (theia.denx.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VqjBRT_CeyFV; Wed, 7 Oct 2015 16:19:33 +0200 (CEST) Received: from theia.denx.de (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id 75CC44B73A; Wed, 7 Oct 2015 16:19:33 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id 30BAE4B73A for ; Wed, 7 Oct 2015 16:19:31 +0200 (CEST) Received: from theia.denx.de ([127.0.0.1]) by localhost (theia.denx.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dlhDudZ8pkUr for ; Wed, 7 Oct 2015 16:19:31 +0200 (CEST) X-policyd-weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_SPAMCOP=-1.5 NOT_IN_BL_NJABL=-1.5 (only DNSBL check requested) Received: from mail-qg0-f42.google.com (mail-qg0-f42.google.com [209.85.192.42]) by theia.denx.de (Postfix) with ESMTPS id C0ED04B736 for ; Wed, 7 Oct 2015 16:19:27 +0200 (CEST) Received: by qgx61 with SMTP id 61so16171795qgx.3 for ; Wed, 07 Oct 2015 07:19:26 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-type:content-disposition:in-reply-to :user-agent; bh=q1+ft2vVt5fjJSG5zXzfQn8KvQrQM8ZwdcljUWCX6ZA=; b=JcXkMdmm8MejZumM4V0MGBektSCA2hFhFgLoz2O3XEjp6hDlZ07VNZTpDDW6FQ0W80 ixWi6FkOHeb40uXDhqVpXDngVAejW6JvHqh178LocmQFi9rrygmUDn+6eP+kJWNYu9DI PoQjNpxUwfdQHtck80NQvD0VuecvMXx/g9BgOMdLq0FwNmT49EMC2iR9LzskbaW+QnEl 3DjzZQ0YpZnGJWoKQqB25ndjjK1WUlA9gyUqddr6W9YrzPOW26KUgpUVFoLk5UUKNtdG U5ILzbnjO2daMOFi9k4wx7F4v0h2XhB08Iuk4Rn0b88bVr9MvkOYFQBGpf3KXC2T6uZd m8bw== X-Gm-Message-State: ALoCoQmg+7hPzc2MyaF+4CjjQQj64NsSLqx198tK+vBXD2pQBSAGTudR3Di859Q23Vo7/R9P/7Gv X-Received: by 10.140.40.139 with SMTP id x11mr1713500qgx.41.1444227565976; Wed, 07 Oct 2015 07:19:25 -0700 (PDT) Received: from bill-the-cat (cpe-75-180-230-22.ec.res.rr.com. [75.180.230.22]) by smtp.gmail.com with ESMTPSA id m26sm11081491qki.28.2015.10.07.07.19.24 (version=TLSv1.2 cipher=RC4-SHA bits=128/128); Wed, 07 Oct 2015 07:19:24 -0700 (PDT) Date: Wed, 7 Oct 2015 10:19:29 -0400 From: Tom Rini To: Vincent =?iso-8859-1?Q?Stehl=E9?= Message-ID: <20151007141929.GO3829@bill-the-cat> References: <1444225728-23057-1-git-send-email-vincent.stehle@freescale.com> MIME-Version: 1.0 In-Reply-To: <1444225728-23057-1-git-send-email-vincent.stehle@freescale.com> User-Agent: Mutt/1.5.21 (2010-09-15) Cc: u-boot@lists.denx.de Subject: Re: [U-Boot] [PATCH] tools/proftool: fix use-after-free X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.15 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" On Wed, Oct 07, 2015 at 03:48:48PM +0200, Vincent Stehlé wrote: > The read_trace_config() can dereference the line pointer after freeing > it on its error path. Avoid that. > > This was found by Coverity Scan. > > Signed-off-by: Vincent Stehlé > Cc: Simon Glass Were you in the Coverity talk too? :) I saw this error as well today now. I was actually thinking along the lines of: diff --git a/tools/proftool.c b/tools/proftool.c index 9ce7a77..b3d3057 100644 --- a/tools/proftool.c +++ b/tools/proftool.c @@ -433,8 +433,9 @@ static int read_trace_config(FILE *fin) err = regcomp(&line->regex, tok, REG_NOSUB); if (err) { free(line); - return regex_report_error(&line->regex, err, "compile", + err = regex_report_error(&line->regex, err, "compile", tok); + return err; } /* link this new one to the end of the list */