lkml.org 
[lkml]   [2012]   [Apr]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 7/7] parse-events: Fix a possibly wrong memory dereference
Date
If set_op_prio() failed, the token will be freed at out_free,
then arg->op.op would turn out to be a dangle pointer. After
returning EVENT_ERROR from process_op(), free_arg() will be
called and then it will finally see the dangling pointer.

Signed-off-by: Namhyung Kim <namhyung.kim@lge.com>
---
parse-events.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/parse-events.c b/parse-events.c
index e789275..bd078ba 100644
--- a/parse-events.c
+++ b/parse-events.c
@@ -1741,6 +1741,8 @@ process_op(struct event_format *event, struct print_arg *arg, char **tok)

if (set_op_prio(arg) == -1) {
event->flags |= EVENT_FL_FAILED;
+ /* arg->op.op (= token) will be freed at out_free */
+ arg->op.op = NULL;
goto out_free;
}

--
1.7.7.6


\
 
 \ /
  Last update: 2012-04-09 04:57    [W:0.106 / U:0.672 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site