david.venhoff/QEMU-Nyx-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

linux-user/elfload.c: Avoid calling g_free() on uninitialized data

Browse Source 
Avoid calling g_free() on unintialized data in the error-handling
paths in elf_core_dump() by splitting the initialization of the
elf_note_info struct out of fill_note_info() so that it's always
valid to call free_note_info() whether we got to the point of
being able to fill_note_info() or not.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Riku Voipio <riku.voipio@linaro.org>
This commit is contained in:
Peter Maydell 2014-02-17 18:55:31 +00:00 committed by Riku Voipio
parent 4fc4732047
commit 6afafa86f3
1 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
linux-user/elfload.c
View File

@ -2636,6 +2636,16 @@ static void fill_thread_info(struct elf_note_info *info, const CPUArchState *env
info->notes_size += note_size(&ets->notes[0]); info->notes_size += note_size(&ets->notes[0]);
} }
static void init_note_info(struct elf_note_info *info)
{
/* Initialize the elf_note_info structure so that it is at
* least safe to call free_note_info() on it. Must be
* called before calling fill_note_info().
*/
memset(info, 0, sizeof (*info));
QTAILQ_INIT(&info->thread_list);
}
static int fill_note_info(struct elf_note_info *info, static int fill_note_info(struct elf_note_info *info,
long signr, const CPUArchState *env) long signr, const CPUArchState *env)
{ {
@ -2644,10 +2654,6 @@ static int fill_note_info(struct elf_note_info *info,
TaskState *ts = (TaskState *)env->opaque; TaskState *ts = (TaskState *)env->opaque;
int i; int i;
(void) memset(info, 0, sizeof (*info));
QTAILQ_INIT(&info->thread_list);
info->notes = g_malloc0(NUMNOTES * sizeof (struct memelfnote)); info->notes = g_malloc0(NUMNOTES * sizeof (struct memelfnote));
if (info->notes == NULL) if (info->notes == NULL)
return (-ENOMEM); return (-ENOMEM);
@ -2781,6 +2787,8 @@ static int elf_core_dump(int signr, const CPUArchState *env)
int segs = 0; int segs = 0;
int fd = -1; int fd = -1;
init_note_info(&info);
errno = 0; errno = 0;
getrlimit(RLIMIT_CORE, &dumpsize); getrlimit(RLIMIT_CORE, &dumpsize);
if (dumpsize.rlim_cur == 0) if (dumpsize.rlim_cur == 0)