Thomas Heijligen has uploaded this change for review.
erasure_layout.c: Test erasefn_count before using it to allocate memory
In erasure_layout.c:create_erase_layout() the layout will be allocated
based on erasefn_count, But calling calloc with 0 is unspecified
behavior. Also it is not freed when erasefn_count is 0.
So test first if erasefn_count is 0, and only when not allocate the
memory for *layout.
Reported by Coverty Scan:
*** CID 1505171: Resource leaks (RESOURCE_LEAK)
/erasure_layout.c: 105 in create_erase_layout()
98 if(!layout) {
99 msg_gerr("Out of memory!\n");
100 return -1;
101 }
102
103 if (!erasefn_count) {
104 msg_gerr("No erase functions supported\n");
>>> CID 1505171: Resource leaks (RESOURCE_LEAK)
>>> Variable "layout" going out of scope leaks the storage it points to.
105 return 0;
106 }
Change-Id: If13b050ac8525fee44d3f3bf74a9c9b6a8d38399
Signed-off-by: Thomas Heijligen <thomas.heijligen@secunet.com>
---
M erasure_layout.c
1 file changed, 37 insertions(+), 7 deletions(-)
git pull ssh://review.coreboot.org:29418/flashrom refs/changes/41/73041/1
diff --git a/erasure_layout.c b/erasure_layout.c
index 05376de..2097b33 100644
--- a/erasure_layout.c
+++ b/erasure_layout.c
@@ -93,18 +93,17 @@
{
const struct flashchip *chip = flashctx->chip;
const size_t erasefn_count = count_usable_erasers(flashctx);
- struct erase_layout *layout = calloc(erasefn_count, sizeof(struct erase_layout));
-
- if (!layout) {
- msg_gerr("Out of memory!\n");
- return -1;
- }
-
if (!erasefn_count) {
msg_gerr("No erase functions supported\n");
return 0;
}
+ struct erase_layout *layout = calloc(erasefn_count, sizeof(struct erase_layout));
+ if (!layout) {
+ msg_gerr("Out of memory!\n");
+ return -1;
+ }
+
size_t layout_idx = 0;
for (size_t eraser_idx = 0; eraser_idx < NUM_ERASEFUNCTIONS; eraser_idx++) {
if (check_block_eraser(flashctx, eraser_idx, 0))
To view, visit change 73041. To unsubscribe, or for help writing mail filters, visit settings.