[PATCH] libext2fs: fix memory leak in block_iterate

[PATCH] libext2fs: fix memory leak in block_iterate

[number9652]

One of the error paths in block_iterate could return before freeing the
scratch memory.  Here we free that memory before returning.

Signed-off-by: Nic Case <number9652@yahoo.com>
---
diff --git a/e2fsprogs-1.41.8-orig/lib/ext2fs/block.c b/e2fsprogs-1.41.8/lib/ext2fs/block.c
index de5342d..bb20f6e 100644
--- a/e2fsprogs-1.41.8-orig/lib/ext2fs/block.c
+++ b/e2fsprogs-1.41.8/lib/ext2fs/block.c
@@ -488,8 +488,11 @@ errcode_t ext2fs_block_iterate2(ext2_filsys fs,
 abort_exit:
        if (ret & BLOCK_CHANGED) {
                retval = ext2fs_write_inode(fs, ino, &inode);
-               if (retval)
+               if (retval) {
+                       if (!block_buf)
+                               ext2fs_free_mem(&ctx.ind_buf);
                        return retval;
+               }
        }
 errout:
        if (!block_buf)
---


      

Re: [PATCH] libext2fs: fix memory leak in block_iterate

[Theodore Tso]

On Tue, Jul 14, 2009 at 09:45:27AM -0700, number9652 wrote:
> 
> One of the error paths in block_iterate could return before freeing the
> scratch memory.  Here we free that memory before returning.

A cleaner patch is simply to let the code in errout: handle freeing
the memory if necessary.  This is what I've checked into the e2fsprogs
maint branch.  Thanks for reporting it!

					- Ted

commit 9922c53a4df10e660a1b425629a1f4db2b4fc03f
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Sat Jul 18 10:02:41 2009 -0400

    libext2fs: fix memory leak in error path in ext2fs_block_iterate2()
    
    Reported-by: Nic Case <number9652@yahoo.com>
    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>

diff --git a/lib/ext2fs/block.c b/lib/ext2fs/block.c
index de5342d..490116d 100644
--- a/lib/ext2fs/block.c
+++ b/lib/ext2fs/block.c
@@ -488,8 +488,10 @@ errcode_t ext2fs_block_iterate2(ext2_filsys fs,
 abort_exit:
 	if (ret & BLOCK_CHANGED) {
 		retval = ext2fs_write_inode(fs, ino, &inode);
-		if (retval)
-			return retval;
+		if (retval) {
+			ret |= BLOCK_ERROR;
+			ctx.errcode = retval;
+		}
 	}
 errout:
 	if (!block_buf)