Author: ngie
Date: Mon Mar 27 18:29:30 2017
New Revision: 316047
URL: https://svnweb.freebsd.org/changeset/base/316047
Log:
MFC r315639:
libcam: NULL out freed `ccb.cdm.matches` and `ccb.cdm.patterns` pointers
This is being done to avoid potential double frees with the values.
Modified:
stable/10/lib/libcam/camlib.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/lib/libcam/camlib.c
==============================================================================
--- stable/10/lib/libcam/camlib.c Mon Mar 27 18:28:17 2017
(r316046)
+++ stable/10/lib/libcam/camlib.c Mon Mar 27 18:29:30 2017
(r316047)
@@ -308,6 +308,7 @@ cam_open_btl(path_id_t path_id, target_i
snprintf(cam_errbuf, CAM_ERRBUF_SIZE,
"%s: couldn't malloc pattern buffer", func_name);
free(ccb.cdm.matches);
+ ccb.cdm.matches = NULL;
close(fd);
return(NULL);
}
@@ -371,7 +372,9 @@ cam_open_btl(path_id_t path_id, target_i
periph_result = &ccb.cdm.matches[0].result.periph_result;
pass_unit = periph_result->unit_number;
free(ccb.cdm.matches);
+ ccb.cdm.matches = NULL;
free(ccb.cdm.patterns);
+ ccb.cdm.patterns = NULL;
close(fd);
sprintf(dev_path, "/dev/pass%d", pass_unit);
return(cam_real_open_device(dev_path, flags, device, NULL,
@@ -388,7 +391,9 @@ cam_open_btl(path_id_t path_id, target_i
btl_bailout:
free(ccb.cdm.matches);
+ ccb.cdm.matches = NULL;
free(ccb.cdm.patterns);
+ ccb.cdm.patterns = NULL;
close(fd);
return(NULL);
}
_______________________________________________
svn-src-stable-10@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"
