Re: [Qemu-devel] [PATCH] bsd_user: Fix potential null pointer dereference

[Stefan Weil <sw@weilnetz.de>]

Am 21.11.2011 20:49, schrieb Peter Maydell:
> On 21 November 2011 19:41, Stefan Weil<sw@weilnetz.de>  wrote:
>> This bug was spotted by cppcheck.
>>
>> Using g_try_malloc0 (as does the linux-user code) fixes this.
>>
>> Signed-off-by: Stefan Weil<sw@weilnetz.de>
> Oh look, another bug in bsd-user it wouldn't have if it shared code
> with linux-user :-)

I had read your previous mail and was waiting for your comment
when I sent my patch :-)

Nobody would mind if Linux and BSD shared more code.
So somebody simply has to do the necessary changes.

>>   bsd-user/elfload.c |    5 ++---
>>   1 files changed, 2 insertions(+), 3 deletions(-)
>>
>> diff --git a/bsd-user/elfload.c b/bsd-user/elfload.c
>> index 1ef1f97..1288884 100644
>> --- a/bsd-user/elfload.c
>> +++ b/bsd-user/elfload.c
>> @@ -641,8 +641,7 @@ static abi_ulong copy_elf_strings(int argc,char ** argv, void **page,
>>                  offset = p % TARGET_PAGE_SIZE;
>>                  pag = (char *)page[p/TARGET_PAGE_SIZE];
>>                  if (!pag) {
>> -                    pag = (char *)malloc(TARGET_PAGE_SIZE);
>> -                    memset(pag, 0, TARGET_PAGE_SIZE);
>> +                    pag = g_try_malloc0(TARGET_PAGE_SIZE);
>>                      page[p/TARGET_PAGE_SIZE] = pag;
>>                      if (!pag)
>>                          return 0;
>> @@ -696,7 +695,7 @@ static abi_ulong setup_arg_pages(abi_ulong p, struct linux_binprm *bprm,
>>              info->rss++;
>>              /* FIXME - check return value of memcpy_to_target() for failure */
>>              memcpy_to_target(stack_base, bprm->page[i], TARGET_PAGE_SIZE);
>> -            free(bprm->page[i]);
>> +            g_free(bprm->page[i]);
>>          }
>>          stack_base += TARGET_PAGE_SIZE;
>>      }
> You've missed the s/free/g_free/ in bsd-user/bsdload.c. Compare
> commit 7dd47667b.
>
> -- PMM

I fixed this in new patch, thank you.

Regards,
Stefan Weil