[PATCH v1 04/11] perf annotate: Smatch: Fix dereferencing freed memory

Leo Yan
2019-07-02T10:35:37Z

Based on the following report from Smatch, fix the potential
dereferencing freed memory check.

tools/perf/util/annotate.c:1125
disasm_line__parse() error: dereferencing freed memory 'namep'

tools/perf/util/annotate.c
1100 static int disasm_line__parse(char *line, const char **namep, char **rawp)
1101 {
1102 char tmp, *name = ltrim(line);

[...]

1114 *namep = strdup(name);
1115
1116 if (*namep == NULL)
1117 goto out_free_name;

[...]

1124 out_free_name:
1125 free((void *)namep);
^^^^^
1126 *namep = NULL;
^^^^^^
1127 return -1;
1128 }

If strdup() fails to allocate memory space for *namep, we don't need to
free memory with pointer 'namep', which is resident in data structure
disasm_line::ins::name; and *namep is NULL pointer for this failure, so
it's pointless to assign NULL to *namep again.

Signed-off-by: Leo Yan <leo.yan@linaro.org>
---
tools/perf/util/annotate.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index c8ce13419d9b..b8dfcfe08bb1 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -1113,16 +1113,14 @@ static int disasm_line__parse(char *line, const char **namep, char **rawp)
*namep = strdup(name);

if (*namep == NULL)
- goto out_free_name;
+ goto out;

(*rawp)[0] = tmp;
*rawp = ltrim(*rawp);

return 0;

-out_free_name:
- free((void *)namep);
- *namep = NULL;
+out:
return -1;
}

--
2.17.1