* [Qemu-devel] [PATCH] bsd_user: Fix potential null pointer dereference
@ 2011-11-21 19:41 Stefan Weil
2011-11-21 19:49 ` Peter Maydell
0 siblings, 1 reply; 6+ messages in thread
From: Stefan Weil @ 2011-11-21 19:41 UTC (permalink / raw)
To: qemu-devel; +Cc: Blue Swirl, Stefan Weil
This bug was spotted by cppcheck.
Using g_try_malloc0 (as does the linux-user code) fixes this.
Signed-off-by: Stefan Weil <sw@weilnetz.de>
---
bsd-user/elfload.c | 5 ++---
1 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/bsd-user/elfload.c b/bsd-user/elfload.c
index 1ef1f97..1288884 100644
--- a/bsd-user/elfload.c
+++ b/bsd-user/elfload.c
@@ -641,8 +641,7 @@ static abi_ulong copy_elf_strings(int argc,char ** argv, void **page,
offset = p % TARGET_PAGE_SIZE;
pag = (char *)page[p/TARGET_PAGE_SIZE];
if (!pag) {
- pag = (char *)malloc(TARGET_PAGE_SIZE);
- memset(pag, 0, TARGET_PAGE_SIZE);
+ pag = g_try_malloc0(TARGET_PAGE_SIZE);
page[p/TARGET_PAGE_SIZE] = pag;
if (!pag)
return 0;
@@ -696,7 +695,7 @@ static abi_ulong setup_arg_pages(abi_ulong p, struct linux_binprm *bprm,
info->rss++;
/* FIXME - check return value of memcpy_to_target() for failure */
memcpy_to_target(stack_base, bprm->page[i], TARGET_PAGE_SIZE);
- free(bprm->page[i]);
+ g_free(bprm->page[i]);
}
stack_base += TARGET_PAGE_SIZE;
}
--
1.7.2.5
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [Qemu-devel] [PATCH] bsd_user: Fix potential null pointer dereference
2011-11-21 19:41 [Qemu-devel] [PATCH] bsd_user: Fix potential null pointer dereference Stefan Weil
@ 2011-11-21 19:49 ` Peter Maydell
2011-11-21 20:06 ` [Qemu-devel] [PATCH v2] " Stefan Weil
2011-11-21 20:13 ` [Qemu-devel] [PATCH] " Stefan Weil
0 siblings, 2 replies; 6+ messages in thread
From: Peter Maydell @ 2011-11-21 19:49 UTC (permalink / raw)
To: Stefan Weil; +Cc: Blue Swirl, qemu-devel
On 21 November 2011 19:41, Stefan Weil <sw@weilnetz.de> wrote:
> This bug was spotted by cppcheck.
>
> Using g_try_malloc0 (as does the linux-user code) fixes this.
>
> Signed-off-by: Stefan Weil <sw@weilnetz.de>
Oh look, another bug in bsd-user it wouldn't have if it shared code
with linux-user :-)
> bsd-user/elfload.c | 5 ++---
> 1 files changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/bsd-user/elfload.c b/bsd-user/elfload.c
> index 1ef1f97..1288884 100644
> --- a/bsd-user/elfload.c
> +++ b/bsd-user/elfload.c
> @@ -641,8 +641,7 @@ static abi_ulong copy_elf_strings(int argc,char ** argv, void **page,
> offset = p % TARGET_PAGE_SIZE;
> pag = (char *)page[p/TARGET_PAGE_SIZE];
> if (!pag) {
> - pag = (char *)malloc(TARGET_PAGE_SIZE);
> - memset(pag, 0, TARGET_PAGE_SIZE);
> + pag = g_try_malloc0(TARGET_PAGE_SIZE);
> page[p/TARGET_PAGE_SIZE] = pag;
> if (!pag)
> return 0;
> @@ -696,7 +695,7 @@ static abi_ulong setup_arg_pages(abi_ulong p, struct linux_binprm *bprm,
> info->rss++;
> /* FIXME - check return value of memcpy_to_target() for failure */
> memcpy_to_target(stack_base, bprm->page[i], TARGET_PAGE_SIZE);
> - free(bprm->page[i]);
> + g_free(bprm->page[i]);
> }
> stack_base += TARGET_PAGE_SIZE;
> }
You've missed the s/free/g_free/ in bsd-user/bsdload.c. Compare
commit 7dd47667b.
-- PMM
^ permalink raw reply [flat|nested] 6+ messages in thread* [Qemu-devel] [PATCH v2] bsd_user: Fix potential null pointer dereference
2011-11-21 19:49 ` Peter Maydell
@ 2011-11-21 20:06 ` Stefan Weil
2011-11-28 17:55 ` Stefan Weil
2011-12-11 16:49 ` Blue Swirl
2011-11-21 20:13 ` [Qemu-devel] [PATCH] " Stefan Weil
1 sibling, 2 replies; 6+ messages in thread
From: Stefan Weil @ 2011-11-21 20:06 UTC (permalink / raw)
To: qemu-devel; +Cc: Blue Swirl, Stefan Weil
This bug was spotted by cppcheck.
Using g_try_malloc0 (as does the linux-user code) fixes this.
v2:
Use g_free in bsdload.c, too. Thanks to Peter Maydell for this hint.
Signed-off-by: Stefan Weil <sw@weilnetz.de>
---
bsd-user/bsdload.c | 2 +-
bsd-user/elfload.c | 5 ++---
2 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/bsd-user/bsdload.c b/bsd-user/bsdload.c
index 6d9bb6f..2abc713 100644
--- a/bsd-user/bsdload.c
+++ b/bsd-user/bsdload.c
@@ -196,7 +196,7 @@ int loader_exec(const char * filename, char ** argv, char ** envp,
/* Something went wrong, return the inode and free the argument pages*/
for (i=0 ; i<MAX_ARG_PAGES ; i++) {
- free(bprm.page[i]);
+ g_free(bprm.page[i]);
}
return(retval);
}
diff --git a/bsd-user/elfload.c b/bsd-user/elfload.c
index 1ef1f97..1288884 100644
--- a/bsd-user/elfload.c
+++ b/bsd-user/elfload.c
@@ -641,8 +641,7 @@ static abi_ulong copy_elf_strings(int argc,char ** argv, void **page,
offset = p % TARGET_PAGE_SIZE;
pag = (char *)page[p/TARGET_PAGE_SIZE];
if (!pag) {
- pag = (char *)malloc(TARGET_PAGE_SIZE);
- memset(pag, 0, TARGET_PAGE_SIZE);
+ pag = g_try_malloc0(TARGET_PAGE_SIZE);
page[p/TARGET_PAGE_SIZE] = pag;
if (!pag)
return 0;
@@ -696,7 +695,7 @@ static abi_ulong setup_arg_pages(abi_ulong p, struct linux_binprm *bprm,
info->rss++;
/* FIXME - check return value of memcpy_to_target() for failure */
memcpy_to_target(stack_base, bprm->page[i], TARGET_PAGE_SIZE);
- free(bprm->page[i]);
+ g_free(bprm->page[i]);
}
stack_base += TARGET_PAGE_SIZE;
}
--
1.7.2.5
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [Qemu-devel] [PATCH v2] bsd_user: Fix potential null pointer dereference
2011-11-21 20:06 ` [Qemu-devel] [PATCH v2] " Stefan Weil
@ 2011-11-28 17:55 ` Stefan Weil
2011-12-11 16:49 ` Blue Swirl
1 sibling, 0 replies; 6+ messages in thread
From: Stefan Weil @ 2011-11-28 17:55 UTC (permalink / raw)
To: Blue Swirl; +Cc: Peter Maydell, Anthony Liguori, qemu-devel
Am 21.11.2011 21:06, schrieb Stefan Weil:
> This bug was spotted by cppcheck.
>
> Using g_try_malloc0 (as does the linux-user code) fixes this.
>
> v2:
> Use g_free in bsdload.c, too. Thanks to Peter Maydell for this hint.
>
> Signed-off-by: Stefan Weil<sw@weilnetz.de>
> ---
> bsd-user/bsdload.c | 2 +-
> bsd-user/elfload.c | 5 ++---
> 2 files changed, 3 insertions(+), 4 deletions(-)
>
> diff --git a/bsd-user/bsdload.c b/bsd-user/bsdload.c
> index 6d9bb6f..2abc713 100644
> --- a/bsd-user/bsdload.c
> +++ b/bsd-user/bsdload.c
> @@ -196,7 +196,7 @@ int loader_exec(const char * filename, char ** argv, char ** envp,
>
> /* Something went wrong, return the inode and free the argument pages*/
> for (i=0 ; i<MAX_ARG_PAGES ; i++) {
> - free(bprm.page[i]);
> + g_free(bprm.page[i]);
> }
> return(retval);
> }
> diff --git a/bsd-user/elfload.c b/bsd-user/elfload.c
> index 1ef1f97..1288884 100644
> --- a/bsd-user/elfload.c
> +++ b/bsd-user/elfload.c
> @@ -641,8 +641,7 @@ static abi_ulong copy_elf_strings(int argc,char ** argv, void **page,
> offset = p % TARGET_PAGE_SIZE;
> pag = (char *)page[p/TARGET_PAGE_SIZE];
> if (!pag) {
> - pag = (char *)malloc(TARGET_PAGE_SIZE);
> - memset(pag, 0, TARGET_PAGE_SIZE);
> + pag = g_try_malloc0(TARGET_PAGE_SIZE);
> page[p/TARGET_PAGE_SIZE] = pag;
> if (!pag)
> return 0;
> @@ -696,7 +695,7 @@ static abi_ulong setup_arg_pages(abi_ulong p, struct linux_binprm *bprm,
> info->rss++;
> /* FIXME - check return value of memcpy_to_target() for failure */
> memcpy_to_target(stack_base, bprm->page[i], TARGET_PAGE_SIZE);
> - free(bprm->page[i]);
> + g_free(bprm->page[i]);
> }
> stack_base += TARGET_PAGE_SIZE;
> }
>
Ping? Can this be fixed in QEMU 1.0?
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [Qemu-devel] [PATCH v2] bsd_user: Fix potential null pointer dereference
2011-11-21 20:06 ` [Qemu-devel] [PATCH v2] " Stefan Weil
2011-11-28 17:55 ` Stefan Weil
@ 2011-12-11 16:49 ` Blue Swirl
1 sibling, 0 replies; 6+ messages in thread
From: Blue Swirl @ 2011-12-11 16:49 UTC (permalink / raw)
To: Stefan Weil; +Cc: qemu-devel
Thanks, applied.
On Mon, Nov 21, 2011 at 20:06, Stefan Weil <sw@weilnetz.de> wrote:
> This bug was spotted by cppcheck.
>
> Using g_try_malloc0 (as does the linux-user code) fixes this.
>
> v2:
> Use g_free in bsdload.c, too. Thanks to Peter Maydell for this hint.
>
> Signed-off-by: Stefan Weil <sw@weilnetz.de>
> ---
> bsd-user/bsdload.c | 2 +-
> bsd-user/elfload.c | 5 ++---
> 2 files changed, 3 insertions(+), 4 deletions(-)
>
> diff --git a/bsd-user/bsdload.c b/bsd-user/bsdload.c
> index 6d9bb6f..2abc713 100644
> --- a/bsd-user/bsdload.c
> +++ b/bsd-user/bsdload.c
> @@ -196,7 +196,7 @@ int loader_exec(const char * filename, char ** argv, char ** envp,
>
> /* Something went wrong, return the inode and free the argument pages*/
> for (i=0 ; i<MAX_ARG_PAGES ; i++) {
> - free(bprm.page[i]);
> + g_free(bprm.page[i]);
> }
> return(retval);
> }
> diff --git a/bsd-user/elfload.c b/bsd-user/elfload.c
> index 1ef1f97..1288884 100644
> --- a/bsd-user/elfload.c
> +++ b/bsd-user/elfload.c
> @@ -641,8 +641,7 @@ static abi_ulong copy_elf_strings(int argc,char ** argv, void **page,
> offset = p % TARGET_PAGE_SIZE;
> pag = (char *)page[p/TARGET_PAGE_SIZE];
> if (!pag) {
> - pag = (char *)malloc(TARGET_PAGE_SIZE);
> - memset(pag, 0, TARGET_PAGE_SIZE);
> + pag = g_try_malloc0(TARGET_PAGE_SIZE);
> page[p/TARGET_PAGE_SIZE] = pag;
> if (!pag)
> return 0;
> @@ -696,7 +695,7 @@ static abi_ulong setup_arg_pages(abi_ulong p, struct linux_binprm *bprm,
> info->rss++;
> /* FIXME - check return value of memcpy_to_target() for failure */
> memcpy_to_target(stack_base, bprm->page[i], TARGET_PAGE_SIZE);
> - free(bprm->page[i]);
> + g_free(bprm->page[i]);
> }
> stack_base += TARGET_PAGE_SIZE;
> }
> --
> 1.7.2.5
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH] bsd_user: Fix potential null pointer dereference
2011-11-21 19:49 ` Peter Maydell
2011-11-21 20:06 ` [Qemu-devel] [PATCH v2] " Stefan Weil
@ 2011-11-21 20:13 ` Stefan Weil
1 sibling, 0 replies; 6+ messages in thread
From: Stefan Weil @ 2011-11-21 20:13 UTC (permalink / raw)
To: Peter Maydell; +Cc: qemu-devel
Am 21.11.2011 20:49, schrieb Peter Maydell:
> On 21 November 2011 19:41, Stefan Weil<sw@weilnetz.de> wrote:
>> This bug was spotted by cppcheck.
>>
>> Using g_try_malloc0 (as does the linux-user code) fixes this.
>>
>> Signed-off-by: Stefan Weil<sw@weilnetz.de>
> Oh look, another bug in bsd-user it wouldn't have if it shared code
> with linux-user :-)
I had read your previous mail and was waiting for your comment
when I sent my patch :-)
Nobody would mind if Linux and BSD shared more code.
So somebody simply has to do the necessary changes.
>> bsd-user/elfload.c | 5 ++---
>> 1 files changed, 2 insertions(+), 3 deletions(-)
>>
>> diff --git a/bsd-user/elfload.c b/bsd-user/elfload.c
>> index 1ef1f97..1288884 100644
>> --- a/bsd-user/elfload.c
>> +++ b/bsd-user/elfload.c
>> @@ -641,8 +641,7 @@ static abi_ulong copy_elf_strings(int argc,char ** argv, void **page,
>> offset = p % TARGET_PAGE_SIZE;
>> pag = (char *)page[p/TARGET_PAGE_SIZE];
>> if (!pag) {
>> - pag = (char *)malloc(TARGET_PAGE_SIZE);
>> - memset(pag, 0, TARGET_PAGE_SIZE);
>> + pag = g_try_malloc0(TARGET_PAGE_SIZE);
>> page[p/TARGET_PAGE_SIZE] = pag;
>> if (!pag)
>> return 0;
>> @@ -696,7 +695,7 @@ static abi_ulong setup_arg_pages(abi_ulong p, struct linux_binprm *bprm,
>> info->rss++;
>> /* FIXME - check return value of memcpy_to_target() for failure */
>> memcpy_to_target(stack_base, bprm->page[i], TARGET_PAGE_SIZE);
>> - free(bprm->page[i]);
>> + g_free(bprm->page[i]);
>> }
>> stack_base += TARGET_PAGE_SIZE;
>> }
> You've missed the s/free/g_free/ in bsd-user/bsdload.c. Compare
> commit 7dd47667b.
>
> -- PMM
I fixed this in new patch, thank you.
Regards,
Stefan Weil
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2011-12-11 16:49 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-11-21 19:41 [Qemu-devel] [PATCH] bsd_user: Fix potential null pointer dereference Stefan Weil
2011-11-21 19:49 ` Peter Maydell
2011-11-21 20:06 ` [Qemu-devel] [PATCH v2] " Stefan Weil
2011-11-28 17:55 ` Stefan Weil
2011-12-11 16:49 ` Blue Swirl
2011-11-21 20:13 ` [Qemu-devel] [PATCH] " Stefan Weil
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).