Blame SOURCES/0460-kern-parser-Fix-a-memory-leak.patch

468bd4
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
468bd4
From: Chris Coulson <chris.coulson@canonical.com>
468bd4
Date: Wed, 18 Nov 2020 00:59:24 +0000
468bd4
Subject: [PATCH] kern/parser: Fix a memory leak
468bd4
468bd4
The getline() function supplied to grub_parser_split_cmdline() returns
468bd4
a newly allocated buffer and can be called multiple times, but the
468bd4
returned buffer is never freed.
468bd4
468bd4
Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
468bd4
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
468bd4
---
468bd4
 grub-core/kern/parser.c | 20 ++++++++++++++++----
468bd4
 1 file changed, 16 insertions(+), 4 deletions(-)
468bd4
468bd4
diff --git a/grub-core/kern/parser.c b/grub-core/kern/parser.c
09e3cc
index d1cf061ad..39e4df65b 100644
468bd4
--- a/grub-core/kern/parser.c
468bd4
+++ b/grub-core/kern/parser.c
468bd4
@@ -140,6 +140,7 @@ grub_parser_split_cmdline (const char *cmdline,
468bd4
   char buffer[1024];
468bd4
   char *bp = buffer;
468bd4
   char *rd = (char *) cmdline;
468bd4
+  char *rp = rd;
468bd4
   char varname[200];
468bd4
   char *vp = varname;
468bd4
   char *args;
468bd4
@@ -149,10 +150,18 @@ grub_parser_split_cmdline (const char *cmdline,
468bd4
   *argv = NULL;
468bd4
   do
468bd4
     {
468bd4
-      if (!rd || !*rd)
468bd4
+      if (rp == NULL || *rp == '\0')
468bd4
 	{
468bd4
+	  if (rd != cmdline)
468bd4
+	    {
468bd4
+	      grub_free (rd);
468bd4
+	      rd = rp = NULL;
468bd4
+	    }
468bd4
 	  if (getline)
468bd4
-	    getline (&rd, 1, getline_data);
468bd4
+	    {
468bd4
+	      getline (&rd, 1, getline_data);
468bd4
+	      rp = rd;
468bd4
+	    }
468bd4
 	  else
468bd4
 	    break;
468bd4
 	}
468bd4
@@ -160,12 +169,12 @@ grub_parser_split_cmdline (const char *cmdline,
468bd4
       if (!rd)
468bd4
 	break;
468bd4
 
468bd4
-      for (; *rd; rd++)
468bd4
+      for (; *rp != '\0'; rp++)
468bd4
 	{
468bd4
 	  grub_parser_state_t newstate;
468bd4
 	  char use;
468bd4
 
468bd4
-	  newstate = grub_parser_cmdline_state (state, *rd, &use;;
468bd4
+	  newstate = grub_parser_cmdline_state (state, *rp, &use;;
468bd4
 
468bd4
 	  /* If a variable was being processed and this character does
468bd4
 	     not describe the variable anymore, write the variable to
468bd4
@@ -198,6 +207,9 @@ grub_parser_split_cmdline (const char *cmdline,
468bd4
     }
468bd4
   while (state != GRUB_PARSER_STATE_TEXT && !check_varstate (state));
468bd4
 
468bd4
+  if (rd != cmdline)
468bd4
+    grub_free (rd);
468bd4
+
468bd4
   /* A special case for when the last character was part of a
468bd4
      variable.  */
468bd4
   add_var (varname, &bp, &vp, state, GRUB_PARSER_STATE_TEXT);