Werner Zeh submitted this change.
drivers/ipmi: Fix buffer double-free
If reading the data for the asset_tag fails, that buffer should be
freed, not the one for serial_number.
Original-Change-Id: I2ecaf7fd0f23f2fb5a6aa0961c7e17fff04847f4
Original-Signed-off-by: Jacob Garber <jgarber1@ualberta.ca>
Original-Found-by: Coverity CID 1419481, 1419485
Original-Reviewed-on: https://review.coreboot.org/c/coreboot/+/39378
Original-Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Original-Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net>
Original-Reviewed-by: Patrick Rudolph <siro@das-labor.org>
Original-Reviewed-by: Angel Pons <th3fanbus@gmail.com>
(cherry picked from commit f8cd291344f2a8b8ecc90cfb7bb5ca864dcc9441)
Change-Id: I4947ba4578b5a41a30e487f5572412cb6ed79a1b
Signed-off-by: Marc Jones <marcj303@gmail.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/55768
Reviewed-by: Martin Roth <martinroth@google.com>
Reviewed-by: Jay Talbott <JayTalbott@sysproconsulting.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
---
M src/drivers/ipmi/ipmi_fru.c
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/drivers/ipmi/ipmi_fru.c b/src/drivers/ipmi/ipmi_fru.c
index 8be53f8..43ee6b3 100644
--- a/src/drivers/ipmi/ipmi_fru.c
+++ b/src/drivers/ipmi/ipmi_fru.c
@@ -319,7 +319,7 @@
goto out;
}
if (!data2str((const uint8_t *)data_ptr, info->asset_tag, length))
- free(info->serial_number);
+ free(info->asset_tag);
}
out:
To view, visit change 55768. To unsubscribe, or for help writing mail filters, visit settings.