dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone

Blame SOURCES/0385-loader-xnu-Free-driverkey-data-when-an-error-is-dete.patch

b1bcb2
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
b1bcb2
From: Marco A Benatto <mbenatto@redhat.com>
b1bcb2
Date: Mon, 30 Nov 2020 12:18:24 -0300
b1bcb2
Subject: [PATCH] loader/xnu: Free driverkey data when an error is detected in
b1bcb2
 grub_xnu_writetree_toheap()
b1bcb2
b1bcb2
... to avoid memory leaks.
b1bcb2
b1bcb2
Fixes: CID 96640
b1bcb2
b1bcb2
Signed-off-by: Marco A Benatto <mbenatto@redhat.com>
b1bcb2
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
b1bcb2
---
b1bcb2
 grub-core/loader/xnu.c | 24 ++++++++++++++++++++----
b1bcb2
 1 file changed, 20 insertions(+), 4 deletions(-)
b1bcb2
b1bcb2
diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c
b1bcb2
index 14e0d65cd27..f7f3a9d45c8 100644
b1bcb2
--- a/grub-core/loader/xnu.c
b1bcb2
+++ b/grub-core/loader/xnu.c
b1bcb2
@@ -227,26 +227,33 @@ grub_xnu_writetree_toheap (grub_addr_t *target, grub_size_t *size)
b1bcb2
   if (! memorymap)
b1bcb2
     return grub_errno;
b1bcb2
 
b1bcb2
-  driverkey = (struct grub_xnu_devtree_key *) grub_malloc (sizeof (*driverkey));
b1bcb2
+  driverkey = (struct grub_xnu_devtree_key *) grub_zalloc (sizeof (*driverkey));
b1bcb2
   if (! driverkey)
b1bcb2
     return grub_errno;
b1bcb2
   driverkey->name = grub_strdup ("DeviceTree");
b1bcb2
   if (! driverkey->name)
b1bcb2
-    return grub_errno;
b1bcb2
+    {
b1bcb2
+      err = grub_errno;
b1bcb2
+      goto fail;
b1bcb2
+    }
b1bcb2
+
b1bcb2
   driverkey->datasize = sizeof (*extdesc);
b1bcb2
   driverkey->next = memorymap->first_child;
b1bcb2
   memorymap->first_child = driverkey;
b1bcb2
   driverkey->data = extdesc
b1bcb2
     = (struct grub_xnu_extdesc *) grub_malloc (sizeof (*extdesc));
b1bcb2
   if (! driverkey->data)
b1bcb2
-    return grub_errno;
b1bcb2
+    {
b1bcb2
+      err = grub_errno;
b1bcb2
+      goto fail;
b1bcb2
+    }
b1bcb2
 
b1bcb2
   /* Allocate the space based on the size with dummy value. */
b1bcb2
   *size = grub_xnu_writetree_get_size (grub_xnu_devtree_root, "/");
b1bcb2
   err = grub_xnu_heap_malloc (ALIGN_UP (*size + 1, GRUB_XNU_PAGESIZE),
b1bcb2
 			      &src, target);
b1bcb2
   if (err)
b1bcb2
-    return err;
b1bcb2
+    goto fail;
b1bcb2
 
b1bcb2
   /* Put real data in the dummy. */
b1bcb2
   extdesc->addr = *target;
b1bcb2
@@ -255,6 +262,15 @@ grub_xnu_writetree_toheap (grub_addr_t *target, grub_size_t *size)
b1bcb2
   /* Write the tree to heap. */
b1bcb2
   grub_xnu_writetree_toheap_real (src, grub_xnu_devtree_root, "/");
b1bcb2
   return GRUB_ERR_NONE;
b1bcb2
+
b1bcb2
+ fail:
b1bcb2
+  memorymap->first_child = NULL;
b1bcb2
+
b1bcb2
+  grub_free (driverkey->data);
b1bcb2
+  grub_free (driverkey->name);
b1bcb2
+  grub_free (driverkey);
b1bcb2
+
b1bcb2
+  return err;
b1bcb2
 }
b1bcb2
 
b1bcb2
 /* Find a key or value in parent key. */