dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone

Blame SOURCES/0365-disk-ldm-Fix-memory-leak-on-uninserted-lv-references.patch

b1bcb2
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
b1bcb2
From: Darren Kenny <darren.kenny@oracle.com>
b1bcb2
Date: Tue, 8 Dec 2020 10:00:51 +0000
b1bcb2
Subject: [PATCH] disk/ldm: Fix memory leak on uninserted lv references
b1bcb2
b1bcb2
The problem here is that the memory allocated to the variable lv is not
b1bcb2
yet inserted into the list that is being processed at the label fail2.
b1bcb2
b1bcb2
As we can already see at line 342, which correctly frees lv before going
b1bcb2
to fail2, we should also be doing that at these earlier jumps to fail2.
b1bcb2
b1bcb2
Fixes: CID 73824
b1bcb2
b1bcb2
Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
b1bcb2
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
b1bcb2
---
b1bcb2
 grub-core/disk/ldm.c | 10 ++++++++--
b1bcb2
 1 file changed, 8 insertions(+), 2 deletions(-)
b1bcb2
b1bcb2
diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c
b1bcb2
index 9c73d2217e9..2a953667986 100644
b1bcb2
--- a/grub-core/disk/ldm.c
b1bcb2
+++ b/grub-core/disk/ldm.c
b1bcb2
@@ -321,7 +321,10 @@ make_vg (grub_disk_t disk,
b1bcb2
 	  lv->visible = 1;
b1bcb2
 	  lv->segments = grub_zalloc (sizeof (*lv->segments));
b1bcb2
 	  if (!lv->segments)
b1bcb2
-	    goto fail2;
b1bcb2
+	    {
b1bcb2
+	      grub_free (lv);
b1bcb2
+	      goto fail2;
b1bcb2
+	    }
b1bcb2
 	  lv->segments->start_extent = 0;
b1bcb2
 	  lv->segments->type = GRUB_DISKFILTER_MIRROR;
b1bcb2
 	  lv->segments->node_count = 0;
b1bcb2
@@ -329,7 +332,10 @@ make_vg (grub_disk_t disk,
b1bcb2
 	  lv->segments->nodes = grub_calloc (lv->segments->node_alloc,
b1bcb2
 					     sizeof (*lv->segments->nodes));
b1bcb2
 	  if (!lv->segments->nodes)
b1bcb2
-	    goto fail2;
b1bcb2
+	    {
b1bcb2
+	      grub_free (lv);
b1bcb2
+	      goto fail2;
b1bcb2
+	    }
b1bcb2
 	  ptr = vblk[i].dynamic;
b1bcb2
 	  if (ptr + *ptr + 1 >= vblk[i].dynamic
b1bcb2
 	      + sizeof (vblk[i].dynamic))