d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix memory allocation edgecases in kvm_argv(..)

Browse Source 
- Don't leak nbufp on realloc failure in kvm_argv
- Catch malloc errors with bufp
- Set buflen last in the "buflen == 0" case to ensure that
  bufp/nbufp is properly reallocated on the next go around

Differential Revision: https://reviews.freebsd.org/D6051
MFC after: 1 week
Reviewed by: jhb, markj
Reported by: cppcheck
Sponsored by: EMC / Isilon Storage Division
This commit is contained in:
Enji Cooper 2016-04-30 09:13:26 +00:00
parent 4cf287c011
commit 68b68bf55d
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
lib/libkvm/kvm_proc.c
View File

@ -666,6 +666,7 @@ kvm_argv(kvm_t *kd, const struct kinfo_proc *kp, int env, int nchr)
static char *buf, *p; static char *buf, *p;
static char **bufp; static char **bufp;
static int argc; static int argc;
char **nbufp;
if (!ISALIVE(kd)) { if (!ISALIVE(kd)) {
_kvm_err(kd, kd->program, _kvm_err(kd, kd->program,
@ -681,9 +682,15 @@ kvm_argv(kvm_t *kd, const struct kinfo_proc *kp, int env, int nchr)
_kvm_err(kd, kd->program, "cannot allocate memory"); _kvm_err(kd, kd->program, "cannot allocate memory");
return (NULL); return (NULL);
} }
buflen = nchr;
argc = 32; argc = 32;
bufp = malloc(sizeof(char *) * argc); bufp = malloc(sizeof(char *) * argc);
if (bufp == NULL) {
free(buf);
buf = NULL;
_kvm_err(kd, kd->program, "cannot allocate memory");
return (NULL);
}
buflen = nchr;
} else if (nchr > buflen) { } else if (nchr > buflen) {
p = realloc(buf, nchr); p = realloc(buf, nchr);
if (p != NULL) { if (p != NULL) {
@ -716,8 +723,10 @@ kvm_argv(kvm_t *kd, const struct kinfo_proc *kp, int env, int nchr)
p += strlen(p) + 1; p += strlen(p) + 1;
if (i >= argc) { if (i >= argc) {
argc += argc; argc += argc;
bufp = realloc(bufp, nbufp = realloc(bufp, sizeof(char *) * argc);
sizeof(char *) * argc); if (nbufp == NULL)
return (NULL);
bufp = nbufp;
} }
} while (p < buf + bufsz); } while (p < buf + bufsz);
bufp[i++] = 0; bufp[i++] = 0;