diff options
| author | Heinrich Schuchardt <heinrich.schuchardt@canonical.com> | 2025-04-14 15:19:24 +0200 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2025-04-21 11:08:03 -0600 |
| commit | 185fdf5e94731df05748b1c576effb52ff7a3ec5 (patch) | |
| tree | 5c1a5e065022bf4be00203c65760de3d7254e276 | |
| parent | 3e6bbc5adc20242a5056cfa142782debc0c368b5 (diff) | |
fs/squashfs: avoid illegal free() in sqfs_opendir()
* Use calloc() to allocate token_list. This avoids an illegal free if
sqfs_tokenize() fails.
* Do not iterate over token_list if it has not been allocated.
Addresses-Coverity-ID: 510453: Null pointer dereferences (FORWARD_NULL)
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Joao Marcos Costa <joaomarcos.costa@bootlin.com>
Reviewed-by: Joao Marcos Costa <jmcosta944@gmail.com>
| -rw-r--r-- | fs/squashfs/sqfs.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c index 7c364686f14..2dcdd60f683 100644 --- a/fs/squashfs/sqfs.c +++ b/fs/squashfs/sqfs.c @@ -949,7 +949,7 @@ static int sqfs_opendir_nest(const char *filename, struct fs_dir_stream **dirsp) goto out; } - token_list = malloc(token_count * sizeof(char *)); + token_list = calloc(token_count, sizeof(char *)); if (!token_list) { ret = -EINVAL; goto out; @@ -987,9 +987,11 @@ static int sqfs_opendir_nest(const char *filename, struct fs_dir_stream **dirsp) *dirsp = (struct fs_dir_stream *)dirs; out: - for (j = 0; j < token_count; j++) - free(token_list[j]); - free(token_list); + if (token_list) { + for (j = 0; j < token_count; j++) + free(token_list[j]); + free(token_list); + } free(pos_list); free(path); if (ret) { |