Skip to content

Commit fcd7a4c

Browse files
committed
fix: leak of the key list on realloc failure in the simple KMI
realloc was assigned back to priv.dk_list, so a failure overwrote the only pointer to the existing buffer with NULL and leaked it. Use a temporary and free the original on failure.
1 parent 65bdd67 commit fcd7a4c

1 file changed

Lines changed: 13 additions & 6 deletions

File tree

src/kmi/simple.c

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -192,13 +192,20 @@ int simple_parse_opts(void *opt_args)
192192
const size_t dk_list_len = (priv.dk_list ? strlen((char *) priv.dk_list) + strlen("/") : 0)
193193
+ strlen((char *) key[i].dk) + strlen(":") + strlen((char *) key[i].dki) + 1;
194194

195-
if (priv.dk_list)
196-
priv.dk_list = (unsigned char*)realloc(priv.dk_list, dk_list_len);
197-
else
195+
if (priv.dk_list) {
196+
unsigned char *expanded = (unsigned char*)realloc(priv.dk_list, dk_list_len);
197+
if (expanded == NULL) {
198+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
199+
free(priv.dk_list);
200+
return -LTFS_NO_MEMORY;
201+
}
202+
priv.dk_list = expanded;
203+
} else {
198204
priv.dk_list = (unsigned char*)calloc(dk_list_len, sizeof(unsigned char));
199-
if (priv.dk_list == NULL) {
200-
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
201-
return -LTFS_NO_MEMORY;
205+
if (priv.dk_list == NULL) {
206+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
207+
return -LTFS_NO_MEMORY;
208+
}
202209
}
203210
*(priv.dk_list + original_dk_list_len) = '\0';
204211

0 commit comments

Comments
 (0)