From: Jia-Ju Bai <baijiaju1...@gmail.com>
In jffs2_add_frag_to_fragtree(), there is an if statement on line 223 to
check whether "this" is NULL:
if (this)
When "this" is NULL, it is used at several places, such as on line 249:
if (this->node)
and on line 260:
if (newfrag->ofs > this->ofs)
Thus possible null-pointer dereferences may occur.
To fix these bugs, -EINVAL is returned when "this" is NULL.
These bugs are found by a static analysis tool STCheck written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1...@gmail.com>
Signed-off-by: Richard Weinberger <rich...@nod.at>
---
cpukit/libfs/src/jffs2/src/nodelist.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpukit/libfs/src/jffs2/src/nodelist.c
b/cpukit/libfs/src/jffs2/src/nodelist.c
index ee44024c92..86dd8e60d1 100644
--- a/cpukit/libfs/src/jffs2/src/nodelist.c
+++ b/cpukit/libfs/src/jffs2/src/nodelist.c
@@ -228,7 +228,7 @@ static int jffs2_add_frag_to_fragtree(struct jffs2_sb_info
*c, struct rb_root *r
lastend = this->ofs + this->size;
} else {
dbg_fragtree2("lookup gave no frag\n");
- lastend = 0;
+ return -EINVAL;
}
/* See if we ran off the end of the fragtree */
--
2.35.3
_______________________________________________
devel mailing list
devel@rtems.org
http://lists.rtems.org/mailman/listinfo/devel
