d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nvmecontrol wdc: Don't pass a bogus pointer to free().

Browse Source 
wdc_get_dui_log_size allocates a buffer and then advances the
returned pointer.  Passing this advanced pointer to free() is UB,
so save the original pointer to pass to free() instead.

Reviewed by:	imp
Reported by:	GCC 12 -Wfree-nonheap-object
Differential Revision:	https://reviews.freebsd.org/D36827
This commit is contained in:
John Baldwin 2022-10-03 16:10:44 -07:00
parent d30a1689f5
commit 1187e46d1b
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sbin/nvmecontrol/modules/wdc/wdc.c
View File

@ -268,7 +268,7 @@ static void
wdc_get_dui_log_size(int fd, uint32_t opcode, uint8_t data_area,
uint64_t *log_size, int len_off)
{
uint8_t *hdr;
uint8_t *hdr, *tofree;
uint8_t max_sections;
int i, j;
uint16_t hdr_ver;
@ -277,7 +277,7 @@ wdc_get_dui_log_size(int fd, uint32_t opcode, uint8_t data_area,
dui_size = 0;
len = 1024;
hdr = (uint8_t*)malloc(len);
tofree = hdr = (uint8_t*)malloc(len);
if (hdr == NULL)
errx(EX_OSERR, "Can't get buffer to read header");
wdc_get_data_dui(fd, opcode, len, 0, hdr, len);
@ -315,7 +315,7 @@ wdc_get_dui_log_size(int fd, uint32_t opcode, uint8_t data_area,
errx(EX_PROTOCOL, "ERROR : No valid header ");
*log_size = dui_size;
free(hdr);
free(tofree);
}
static void