tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

disk/ldm: Make sure comp data is freed before exiting from make_vg()

Browse Source 
Several error handling paths in make_vg() do not free comp data before
jumping to fail2 label and returning from the function. This will leak
memory. So, let's fix all issues of that kind.

Fixes: CID 73804

Signed-off-by: Marco A Benatto <mbenatto@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Marco A Benatto 2020-12-07 11:53:03 -03:00 committed by Daniel Kiper
parent bc9c468a2c
commit 23e39f50ca
1 changed files with 44 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
grub-core/disk/ldm.c
View File

@ -554,7 +554,11 @@ make_vg (grub_disk_t disk,
comp->segments = grub_calloc (comp->segment_alloc,
sizeof (*comp->segments));
if (!comp->segments)
goto fail2;
{
grub_free (comp->internal_id);
grub_free (comp);
goto fail2;
}
}
else
{
@ -562,7 +566,11 @@ make_vg (grub_disk_t disk,
comp->segment_count = 1;
comp->segments = grub_malloc (sizeof (*comp->segments));
if (!comp->segments)
goto fail2;
{
grub_free (comp->internal_id);
grub_free (comp);
goto fail2;
}
comp->segments->start_extent = 0;
comp->segments->extent_count = lv->size;
comp->segments->layout = 0;
@ -574,15 +582,26 @@ make_vg (grub_disk_t disk,
comp->segments->layout = GRUB_RAID_LAYOUT_SYMMETRIC_MASK;
}
else
goto fail2;
{
grub_free (comp->segments);
grub_free (comp->internal_id);
grub_free (comp);
goto fail2;
}
ptr += *ptr + 1;
ptr++;
if (!(vblk[i].flags & 0x10))
goto fail2;
{
grub_free (comp->segments);
grub_free (comp->internal_id);
grub_free (comp);
goto fail2;
}
if (ptr >= vblk[i].dynamic + sizeof (vblk[i].dynamic)
|| ptr + *ptr + 1 >= vblk[i].dynamic
+ sizeof (vblk[i].dynamic))
{
grub_free (comp->segments);
grub_free (comp->internal_id);
grub_free (comp);
goto fail2;
@ -592,6 +611,7 @@ make_vg (grub_disk_t disk,
if (ptr + *ptr + 1 >= vblk[i].dynamic
+ sizeof (vblk[i].dynamic))
{
grub_free (comp->segments);
grub_free (comp->internal_id);
grub_free (comp);
goto fail2;
@ -601,7 +621,12 @@ make_vg (grub_disk_t disk,
comp->segments->nodes = grub_calloc (comp->segments->node_alloc,
sizeof (*comp->segments->nodes));
if (!lv->segments->nodes)
goto fail2;
{
grub_free (comp->segments);
grub_free (comp->internal_id);
grub_free (comp);
goto fail2;
}
}
if (lv->segments->node_alloc == lv->segments->node_count)
@ -611,11 +636,23 @@ make_vg (grub_disk_t disk,
if (grub_mul (lv->segments->node_alloc, 2, &lv->segments->node_alloc) ||
grub_mul (lv->segments->node_alloc, sizeof (*lv->segments->nodes), &sz))
goto fail2;
{
grub_free (comp->segments->nodes);
grub_free (comp->segments);
grub_free (comp->internal_id);
grub_free (comp);
goto fail2;
}
t = grub_realloc (lv->segments->nodes, sz);
if (!t)
goto fail2;
{
grub_free (comp->segments->nodes);
grub_free (comp->segments);
grub_free (comp->internal_id);
grub_free (comp);
goto fail2;
}
lv->segments->nodes = t;
}
lv->segments->nodes[lv->segments->node_count].pv = 0;