diff mbox series

[iproute2,v2,2/2] bpf: Fix mem leak and extraneous free() in error path

Message ID 20200422102808.9197-3-jhs@emojatatu.com
State Changes Requested
Delegated to: stephen hemminger
Headers show
Series bpf: memory access fixes | expand

Commit Message

Jamal Hadi Salim April 22, 2020, 10:28 a.m. UTC 
From: Jamal Hadi Salim <hadi@mojatatu.com>

Fixes: c0325b06382 ("bpf: replace snprintf with asprintf when dealing with long buffers")
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
---
 lib/bpf.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

Comments

Dominique Martinet April 22, 2020, 2:44 p.m. UTC | #1 
Jamal Hadi Salim wrote on Wed, Apr 22, 2020:
>  	sub = strtok(rem, "/");
>  	while (sub) {
> -		if (strlen(tmp) + strlen(sub) + 2 > PATH_MAX)
> -			return -EINVAL;
> +		if (strlen(tmp) + strlen(sub) + 2 > PATH_MAX) {
> +			ret = -EINVAL;
> +			goto out;
> +		}

Now I'm looking at this we're a bit inconsistent with return values in
this function, other error paths return negative value + errno set,
and this only returns -errno.

Digging a bit into callers it looks like errno is the way to go, so
while you're modifying this it might be worth setting errno to EINVAL as
well here?


Cheers & sorry for nitpicking,
diff mbox series

Patch

diff --git a/lib/bpf.c b/lib/bpf.c
index 656cad02..fdcede1c 100644
--- a/lib/bpf.c
+++ b/lib/bpf.c
@@ -1523,13 +1523,15 @@  static int bpf_make_custom_path(const struct bpf_elf_ctx *ctx,
 	ret = asprintf(&rem, "%s/", todo);
 	if (ret < 0) {
 		fprintf(stderr, "asprintf failed: %s\n", strerror(errno));
-		goto out;
+		return ret;
 	}
 
 	sub = strtok(rem, "/");
 	while (sub) {
-		if (strlen(tmp) + strlen(sub) + 2 > PATH_MAX)
-			return -EINVAL;
+		if (strlen(tmp) + strlen(sub) + 2 > PATH_MAX) {
+			ret = -EINVAL;
+			goto out;
+		}
 
 		strcat(tmp, sub);
 		strcat(tmp, "/");