From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34316) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WFTML-0000eO-RE for qemu-devel@nongnu.org; Mon, 17 Feb 2014 13:56:06 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WFTMK-0007md-SS for qemu-devel@nongnu.org; Mon, 17 Feb 2014 13:56:05 -0500 Received: from mnementh.archaic.org.uk ([2001:8b0:1d0::1]:45982) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WFTMK-0007ix-Lv for qemu-devel@nongnu.org; Mon, 17 Feb 2014 13:56:04 -0500 From: Peter Maydell Date: Mon, 17 Feb 2014 18:55:34 +0000 Message-Id: <1392663334-8555-5-git-send-email-peter.maydell@linaro.org> In-Reply-To: <1392663334-8555-1-git-send-email-peter.maydell@linaro.org> References: <1392663334-8555-1-git-send-email-peter.maydell@linaro.org> Subject: [Qemu-devel] [PATCH 4/4] linux-user: Fix error handling in target_to_host_semarray() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Riku Voipio , patches@linaro.org Fix two issues in error handling in target_to_host_semarray(): * don't leak the host_array buffer if lock_user fails * return an error if malloc() fails Signed-off-by: Peter Maydell --- linux-user/syscall.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index bb3e4b1..c92f026 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -2429,10 +2429,15 @@ static inline abi_long target_to_host_semarray(int semid, unsigned short **host_ nsems = semid_ds.sem_nsems; *host_array = malloc(nsems*sizeof(unsigned short)); + if (!*host_array) { + return -TARGET_ENOMEM; + } array = lock_user(VERIFY_READ, target_addr, nsems*sizeof(unsigned short), 1); - if (!array) + if (!array) { + free(host_array); return -TARGET_EFAULT; + } for(i=0; i