nvmecontrol wdc: Don't pass a bogus pointer to free().
wdc_get_dui_log_size allocates a buffer and then advances the returned pointer. Passing this advanced pointer to free() is UB, so save the original pointer to pass to free() instead. Reviewed by: imp Reported by: GCC 12 -Wfree-nonheap-object Differential Revision: https://reviews.freebsd.org/D36827
This commit is contained in:
parent
d30a1689f5
commit
1187e46d1b
@ -268,7 +268,7 @@ static void
|
||||
wdc_get_dui_log_size(int fd, uint32_t opcode, uint8_t data_area,
|
||||
uint64_t *log_size, int len_off)
|
||||
{
|
||||
uint8_t *hdr;
|
||||
uint8_t *hdr, *tofree;
|
||||
uint8_t max_sections;
|
||||
int i, j;
|
||||
uint16_t hdr_ver;
|
||||
@ -277,7 +277,7 @@ wdc_get_dui_log_size(int fd, uint32_t opcode, uint8_t data_area,
|
||||
|
||||
dui_size = 0;
|
||||
len = 1024;
|
||||
hdr = (uint8_t*)malloc(len);
|
||||
tofree = hdr = (uint8_t*)malloc(len);
|
||||
if (hdr == NULL)
|
||||
errx(EX_OSERR, "Can't get buffer to read header");
|
||||
wdc_get_data_dui(fd, opcode, len, 0, hdr, len);
|
||||
@ -315,7 +315,7 @@ wdc_get_dui_log_size(int fd, uint32_t opcode, uint8_t data_area,
|
||||
errx(EX_PROTOCOL, "ERROR : No valid header ");
|
||||
|
||||
*log_size = dui_size;
|
||||
free(hdr);
|
||||
free(tofree);
|
||||
}
|
||||
|
||||
static void
|
||||
|
Loading…
Reference in New Issue
Block a user