lkml.org 
[lkml]   [2019]   [Jul]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH v1 04/11] perf annotate: Smatch: Fix dereferencing freed memory
Em Tue, Jul 02, 2019 at 06:34:13PM +0800, Leo Yan escreveu:
> Based on the following report from Smatch, fix the potential
> dereferencing freed memory check.
>
> tools/perf/util/annotate.c:1125
> disasm_line__parse() error: dereferencing freed memory 'namep'
>
> tools/perf/util/annotate.c
> 1100 static int disasm_line__parse(char *line, const char **namep, char **rawp)
> 1101 {
> 1102 char tmp, *name = ltrim(line);
>
> [...]
>
> 1114 *namep = strdup(name);
> 1115
> 1116 if (*namep == NULL)
> 1117 goto out_free_name;
>
> [...]
>
> 1124 out_free_name:
> 1125 free((void *)namep);
> ^^^^^
> 1126 *namep = NULL;
> ^^^^^^
> 1127 return -1;
> 1128 }
>
> If strdup() fails to allocate memory space for *namep, we don't need to
> free memory with pointer 'namep', which is resident in data structure
> disasm_line::ins::name; and *namep is NULL pointer for this failure, so
> it's pointless to assign NULL to *namep again.

Applied, with this extra comment:


Committer note:

Freeing namep, which is the address of the first entry of the 'struct
ins' that is the first member of struct disasm_line would in fact free
that disasm_line instance, if it was allocated via malloc/calloc, which,
later, would a dereference of freed memory.

\
 
 \ /
  Last update: 2019-07-03 20:54    [W:0.225 / U:0.180 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site