* [PATCH] erofs-utils: s3: fix memory leak in s3erofs_create_object_iterator
@ 2026-04-04 8:27 Nithurshen
2026-04-05 6:22 ` Yifan Zhao
2026-04-05 6:32 ` [PATCH v2] " Nithurshen
0 siblings, 2 replies; 3+ messages in thread
From: Nithurshen @ 2026-04-04 8:27 UTC (permalink / raw)
To: linux-erofs; +Cc: hsiangkao, xiang, nithurshen.dev
In s3erofs_create_object_iterator(), if the parsed prefix length
exceeds S3EROFS_PATH_MAX, the function aborts and returns an
-EINVAL error pointer. However, the 'iter' structure was already
allocated via calloc() and left unfreed, causing a memory leak.
This commit adds the missing free(iter) call in the error path to
prevent leaking memory when excessively long S3 bucket paths are
provided.
Signed-off-by: Nithurshen <nithurshen.dev@gmail.com>
---
lib/remotes/s3.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/lib/remotes/s3.c b/lib/remotes/s3.c
index 768232a..94b4ffb 100644
--- a/lib/remotes/s3.c
+++ b/lib/remotes/s3.c
@@ -911,8 +911,10 @@ s3erofs_create_object_iterator(struct erofs_s3 *s3, const char *path,
iter->bucket = NULL;
iter->prefix = strdup(path + 1);
} else {
- if (++prefix - path > S3EROFS_PATH_MAX)
+ if (++prefix - path > S3EROFS_PATH_MAX){
+ free(iter);
return ERR_PTR(-EINVAL);
+ }
iter->bucket = strndup(path, prefix - path);
iter->prefix = strdup(prefix);
}
--
2.52.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] erofs-utils: s3: fix memory leak in s3erofs_create_object_iterator
2026-04-04 8:27 [PATCH] erofs-utils: s3: fix memory leak in s3erofs_create_object_iterator Nithurshen
@ 2026-04-05 6:22 ` Yifan Zhao
2026-04-05 6:32 ` [PATCH v2] " Nithurshen
1 sibling, 0 replies; 3+ messages in thread
From: Yifan Zhao @ 2026-04-05 6:22 UTC (permalink / raw)
To: Nithurshen, linux-erofs; +Cc: hsiangkao, xiang
On 4/4/2026 4:27 PM, Nithurshen wrote:
> In s3erofs_create_object_iterator(), if the parsed prefix length
> exceeds S3EROFS_PATH_MAX, the function aborts and returns an
> -EINVAL error pointer. However, the 'iter' structure was already
> allocated via calloc() and left unfreed, causing a memory leak.
>
> This commit adds the missing free(iter) call in the error path to
> prevent leaking memory when excessively long S3 bucket paths are
> provided.
>
> Signed-off-by: Nithurshen <nithurshen.dev@gmail.com>
> ---
> lib/remotes/s3.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/lib/remotes/s3.c b/lib/remotes/s3.c
> index 768232a..94b4ffb 100644
> --- a/lib/remotes/s3.c
> +++ b/lib/remotes/s3.c
> @@ -911,8 +911,10 @@ s3erofs_create_object_iterator(struct erofs_s3 *s3, const char *path,
> iter->bucket = NULL;
> iter->prefix = strdup(path + 1);
> } else {
> - if (++prefix - path > S3EROFS_PATH_MAX)
> + if (++prefix - path > S3EROFS_PATH_MAX){
missing a space before the brace, otherwise LGTM.
Reviewed-by: Yifan Zhao <stopire@gmail.com>
> + free(iter);
> return ERR_PTR(-EINVAL);
> + }
> iter->bucket = strndup(path, prefix - path);
> iter->prefix = strdup(prefix);
> }
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH v2] erofs-utils: s3: fix memory leak in s3erofs_create_object_iterator
2026-04-04 8:27 [PATCH] erofs-utils: s3: fix memory leak in s3erofs_create_object_iterator Nithurshen
2026-04-05 6:22 ` Yifan Zhao
@ 2026-04-05 6:32 ` Nithurshen
1 sibling, 0 replies; 3+ messages in thread
From: Nithurshen @ 2026-04-05 6:32 UTC (permalink / raw)
To: nithurshen.dev; +Cc: hsiangkao, linux-erofs, xiang, stopire
In s3erofs_create_object_iterator(), if the parsed prefix length
exceeds S3EROFS_PATH_MAX, the function aborts and returns an
-EINVAL error pointer. However, the 'iter' structure was already
allocated via calloc() and left unfreed, causing a memory leak.
This commit adds the missing free(iter) call in the error path to
prevent leaking memory when excessively long S3 bucket paths are
provided.
Signed-off-by: Nithurshen <nithurshen.dev@gmail.com>
---
lib/remotes/s3.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/lib/remotes/s3.c b/lib/remotes/s3.c
index 768232a..abfa5dc 100644
--- a/lib/remotes/s3.c
+++ b/lib/remotes/s3.c
@@ -911,8 +911,10 @@ s3erofs_create_object_iterator(struct erofs_s3 *s3, const char *path,
iter->bucket = NULL;
iter->prefix = strdup(path + 1);
} else {
- if (++prefix - path > S3EROFS_PATH_MAX)
+ if (++prefix - path > S3EROFS_PATH_MAX) {
+ free(iter);
return ERR_PTR(-EINVAL);
+ }
iter->bucket = strndup(path, prefix - path);
iter->prefix = strdup(prefix);
}
--
2.52.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-04-05 6:32 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-04 8:27 [PATCH] erofs-utils: s3: fix memory leak in s3erofs_create_object_iterator Nithurshen
2026-04-05 6:22 ` Yifan Zhao
2026-04-05 6:32 ` [PATCH v2] " Nithurshen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox