Messages in this thread Patch in this message | | | From | Namhyung Kim <> | Subject | [PATCH 7/7] parse-events: Fix a possibly wrong memory dereference | Date | Mon, 9 Apr 2012 11:54:34 +0900 |
| |
If set_op_prio() failed, the token will be freed at out_free, then arg->op.op would turn out to be a dangle pointer. After returning EVENT_ERROR from process_op(), free_arg() will be called and then it will finally see the dangling pointer.
Signed-off-by: Namhyung Kim <namhyung.kim@lge.com> --- parse-events.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/parse-events.c b/parse-events.c index e789275..bd078ba 100644 --- a/parse-events.c +++ b/parse-events.c @@ -1741,6 +1741,8 @@ process_op(struct event_format *event, struct print_arg *arg, char **tok) if (set_op_prio(arg) == -1) { event->flags |= EVENT_FL_FAILED; + /* arg->op.op (= token) will be freed at out_free */ + arg->op.op = NULL; goto out_free; } -- 1.7.7.6
| |