nvmecontrol wdc: Don't pass a bogus pointer to free().
wdc_get_dui_log_size allocates a buffer and then advances the returned pointer. Passing this advanced pointer to free() is UB, so save the original pointer to pass to free() instead. Reviewed by: imp Reported by: GCC 12 -Wfree-nonheap-object Differential Revision: https://reviews.freebsd.org/D36827
This commit is contained in:
parent
d30a1689f5
commit
1187e46d1b
@ -268,7 +268,7 @@ static void
|
|||||||
wdc_get_dui_log_size(int fd, uint32_t opcode, uint8_t data_area,
|
wdc_get_dui_log_size(int fd, uint32_t opcode, uint8_t data_area,
|
||||||
uint64_t *log_size, int len_off)
|
uint64_t *log_size, int len_off)
|
||||||
{
|
{
|
||||||
uint8_t *hdr;
|
uint8_t *hdr, *tofree;
|
||||||
uint8_t max_sections;
|
uint8_t max_sections;
|
||||||
int i, j;
|
int i, j;
|
||||||
uint16_t hdr_ver;
|
uint16_t hdr_ver;
|
||||||
@ -277,7 +277,7 @@ wdc_get_dui_log_size(int fd, uint32_t opcode, uint8_t data_area,
|
|||||||
|
|
||||||
dui_size = 0;
|
dui_size = 0;
|
||||||
len = 1024;
|
len = 1024;
|
||||||
hdr = (uint8_t*)malloc(len);
|
tofree = hdr = (uint8_t*)malloc(len);
|
||||||
if (hdr == NULL)
|
if (hdr == NULL)
|
||||||
errx(EX_OSERR, "Can't get buffer to read header");
|
errx(EX_OSERR, "Can't get buffer to read header");
|
||||||
wdc_get_data_dui(fd, opcode, len, 0, hdr, len);
|
wdc_get_data_dui(fd, opcode, len, 0, hdr, len);
|
||||||
@ -315,7 +315,7 @@ wdc_get_dui_log_size(int fd, uint32_t opcode, uint8_t data_area,
|
|||||||
errx(EX_PROTOCOL, "ERROR : No valid header ");
|
errx(EX_PROTOCOL, "ERROR : No valid header ");
|
||||||
|
|
||||||
*log_size = dui_size;
|
*log_size = dui_size;
|
||||||
free(hdr);
|
free(tofree);
|
||||||
}
|
}
|
||||||
|
|
||||||
static void
|
static void
|
||||||
|
Loading…
Reference in New Issue
Block a user