From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:40136) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RSaG3-0006ln-LJ for qemu-devel@nongnu.org; Mon, 21 Nov 2011 15:14:31 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RSaFz-0001oW-RZ for qemu-devel@nongnu.org; Mon, 21 Nov 2011 15:14:27 -0500 Received: from v220110690675601.yourvserver.net ([78.47.199.172]:41592) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RSaFz-0001n1-Mn for qemu-devel@nongnu.org; Mon, 21 Nov 2011 15:14:23 -0500 Message-ID: <4ECAB0EB.3050601@weilnetz.de> Date: Mon, 21 Nov 2011 21:13:31 +0100 From: Stefan Weil MIME-Version: 1.0 References: <1321904518-30819-1-git-send-email-sw@weilnetz.de> In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] bsd_user: Fix potential null pointer dereference List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Peter Maydell Cc: qemu-devel@nongnu.org Am 21.11.2011 20:49, schrieb Peter Maydell: > On 21 November 2011 19:41, Stefan Weil wrote: >> This bug was spotted by cppcheck. >> >> Using g_try_malloc0 (as does the linux-user code) fixes this. >> >> Signed-off-by: Stefan Weil > Oh look, another bug in bsd-user it wouldn't have if it shared code > with linux-user :-) I had read your previous mail and was waiting for your comment when I sent my patch :-) Nobody would mind if Linux and BSD shared more code. So somebody simply has to do the necessary changes. >> bsd-user/elfload.c | 5 ++--- >> 1 files changed, 2 insertions(+), 3 deletions(-) >> >> diff --git a/bsd-user/elfload.c b/bsd-user/elfload.c >> index 1ef1f97..1288884 100644 >> --- a/bsd-user/elfload.c >> +++ b/bsd-user/elfload.c >> @@ -641,8 +641,7 @@ static abi_ulong copy_elf_strings(int argc,char ** argv, void **page, >> offset = p % TARGET_PAGE_SIZE; >> pag = (char *)page[p/TARGET_PAGE_SIZE]; >> if (!pag) { >> - pag = (char *)malloc(TARGET_PAGE_SIZE); >> - memset(pag, 0, TARGET_PAGE_SIZE); >> + pag = g_try_malloc0(TARGET_PAGE_SIZE); >> page[p/TARGET_PAGE_SIZE] = pag; >> if (!pag) >> return 0; >> @@ -696,7 +695,7 @@ static abi_ulong setup_arg_pages(abi_ulong p, struct linux_binprm *bprm, >> info->rss++; >> /* FIXME - check return value of memcpy_to_target() for failure */ >> memcpy_to_target(stack_base, bprm->page[i], TARGET_PAGE_SIZE); >> - free(bprm->page[i]); >> + g_free(bprm->page[i]); >> } >> stack_base += TARGET_PAGE_SIZE; >> } > You've missed the s/free/g_free/ in bsd-user/bsdload.c. Compare > commit 7dd47667b. > > -- PMM I fixed this in new patch, thank you. Regards, Stefan Weil