Blame SOURCES/0460-kern-parser-Fix-a-memory-leak.patch

9723a8
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
9723a8
From: Chris Coulson <chris.coulson@canonical.com>
9723a8
Date: Wed, 18 Nov 2020 00:59:24 +0000
9723a8
Subject: [PATCH] kern/parser: Fix a memory leak
9723a8
9723a8
The getline() function supplied to grub_parser_split_cmdline() returns
9723a8
a newly allocated buffer and can be called multiple times, but the
9723a8
returned buffer is never freed.
9723a8
9723a8
Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
9723a8
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
9723a8
---
9723a8
 grub-core/kern/parser.c | 20 ++++++++++++++++----
9723a8
 1 file changed, 16 insertions(+), 4 deletions(-)
9723a8
9723a8
diff --git a/grub-core/kern/parser.c b/grub-core/kern/parser.c
9723a8
index d1cf061ad68..39e4df65b86 100644
9723a8
--- a/grub-core/kern/parser.c
9723a8
+++ b/grub-core/kern/parser.c
9723a8
@@ -140,6 +140,7 @@ grub_parser_split_cmdline (const char *cmdline,
9723a8
   char buffer[1024];
9723a8
   char *bp = buffer;
9723a8
   char *rd = (char *) cmdline;
9723a8
+  char *rp = rd;
9723a8
   char varname[200];
9723a8
   char *vp = varname;
9723a8
   char *args;
9723a8
@@ -149,10 +150,18 @@ grub_parser_split_cmdline (const char *cmdline,
9723a8
   *argv = NULL;
9723a8
   do
9723a8
     {
9723a8
-      if (!rd || !*rd)
9723a8
+      if (rp == NULL || *rp == '\0')
9723a8
 	{
9723a8
+	  if (rd != cmdline)
9723a8
+	    {
9723a8
+	      grub_free (rd);
9723a8
+	      rd = rp = NULL;
9723a8
+	    }
9723a8
 	  if (getline)
9723a8
-	    getline (&rd, 1, getline_data);
9723a8
+	    {
9723a8
+	      getline (&rd, 1, getline_data);
9723a8
+	      rp = rd;
9723a8
+	    }
9723a8
 	  else
9723a8
 	    break;
9723a8
 	}
9723a8
@@ -160,12 +169,12 @@ grub_parser_split_cmdline (const char *cmdline,
9723a8
       if (!rd)
9723a8
 	break;
9723a8
 
9723a8
-      for (; *rd; rd++)
9723a8
+      for (; *rp != '\0'; rp++)
9723a8
 	{
9723a8
 	  grub_parser_state_t newstate;
9723a8
 	  char use;
9723a8
 
9723a8
-	  newstate = grub_parser_cmdline_state (state, *rd, &use;;
9723a8
+	  newstate = grub_parser_cmdline_state (state, *rp, &use;;
9723a8
 
9723a8
 	  /* If a variable was being processed and this character does
9723a8
 	     not describe the variable anymore, write the variable to
9723a8
@@ -198,6 +207,9 @@ grub_parser_split_cmdline (const char *cmdline,
9723a8
     }
9723a8
   while (state != GRUB_PARSER_STATE_TEXT && !check_varstate (state));
9723a8
 
9723a8
+  if (rd != cmdline)
9723a8
+    grub_free (rd);
9723a8
+
9723a8
   /* A special case for when the last character was part of a
9723a8
      variable.  */
9723a8
   add_var (varname, &bp, &vp, state, GRUB_PARSER_STATE_TEXT);