[Cluster-devel] [PATCH] hexedit: avoid NULL dereference upon failed malloc

[Jim Meyering <jim@meyering.net>]

The patch I posted yesterday didn't even compile (missing "&" in memset)
Thanks to Andy Price for checking and reporting that.

Here's the corrected version:

From 152dbe7a8961cebf355b2f648f813e0c74b5e25f Mon Sep 17 00:00:00 2001
From: Jim Meyering <meyering@redhat.com>
Date: Wed, 17 Jun 2009 16:54:03 +0200
Subject: [PATCH] hexedit: avoid NULL dereference upon failed malloc

* gfs2/edit/hexedit.c (display_indirect): Avoid unchecked malloc
by declaring more_indir on the stack.
---
 gfs2/edit/hexedit.c |   14 ++++++--------
 1 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/gfs2/edit/hexedit.c b/gfs2/edit/hexedit.c
index e8c6030..eef2a7a 100644
--- a/gfs2/edit/hexedit.c
+++ b/gfs2/edit/hexedit.c
@@ -1477,13 +1477,12 @@ static int display_indirect(struct iinfo *ind, int indblocks, int level, uint64_
 			file_offset = 0;
 		if (!termlines && ((level + 1 < di.di_height) ||
 				   (S_ISDIR(di.di_mode) && !level))) {
-			struct iinfo *more_indir;
 			int more_ind;
 			char *tmpbuf;
 			
-			more_indir = malloc(sizeof(struct iinfo));
 			tmpbuf = malloc(sbd.bsize);
 			if (tmpbuf) {
+				struct iinfo more_indir;
 				lseek(sbd.device_fd,
 				      ind->ii[pndx].block * sbd.bsize,
 				      SEEK_SET);
@@ -1498,20 +1497,19 @@ static int display_indirect(struct iinfo *ind, int indblocks, int level, uint64_
 						(unsigned long long)ind->ii[pndx].block);
 					exit(-1);
 				}
-				memset(more_indir, 0, sizeof(struct iinfo));
+				memset(&more_indir, 0, sizeof(struct iinfo));
 				if (S_ISDIR(di.di_mode)) {
-					do_leaf_extended(tmpbuf, more_indir);
-					display_leaf(more_indir);
+					do_leaf_extended(tmpbuf, &more_indir);
+					display_leaf(&more_indir);
 				} else {
 					more_ind = do_indirect_extended(tmpbuf,
-									more_indir);
-					display_indirect(more_indir,
+									&more_indir);
+					display_indirect(&more_indir,
 							 more_ind, level + 1,
 							 file_offset);
 				}
 				free(tmpbuf);
 			}
-			free(more_indir);
 		}
 		print_entry_ndx = pndx; /* restore after recursion */
 		eol(0);
-- 
1.6.3.2.406.gd6a466