Fix "use after free"

Change-Id: I832770abb9ad0dbdee65fe14883c31cd317ed73d

diff --git a/src/blkid-api.c b/src/blkid-api.c
index 73b5df632df6069301bfc6f0c97b9bd742f50684..765b0fc8c03762cee9cfa39682cc2a5a756aefc9 100644 (file)
--- a/src/blkid-api.c
+++ b/src/blkid-api.c
@@ -17,15 +17,17 @@
  */
 
 #include "blkid-api.h"
+#include <assert.h>
 #include <stdio.h>
 #include <string.h>
 
-blkid_partlist get_part_list(char *device_name) {
-       blkid_probe pr = blkid_new_probe_from_filename(device_name);
+blkid_partlist get_part_list(char *device_name, blkid_probe *pr) {
+       assert(pr);
+
+       *pr = blkid_new_probe_from_filename(device_name);
        if (pr == NULL)
                return NULL;
-       blkid_partlist ls = blkid_probe_get_partitions(pr);
-       blkid_free_probe(pr);
+       blkid_partlist ls = blkid_probe_get_partitions(*pr);
        return ls;
 }
 

diff --git a/src/blkid-api.h b/src/blkid-api.h
index 0a404f8671d8b01214c229520d3858cecbb21d0c..0baa2f21b92c212f198549c0bcc7e3389c54ad71 100644 (file)
--- a/src/blkid-api.h
+++ b/src/blkid-api.h
@@ -22,5 +22,5 @@
 #ifndef MAX_PARTNAME_LEN
 #define MAX_PARTNAME_LEN 10000
 #endif
-blkid_partlist get_part_list(char *device_name);
+blkid_partlist get_part_list(char *device_name, blkid_probe *pr);
 int get_part_number_by_name(blkid_partlist ls, const char *part_name, const char *new_slot);

diff --git a/src/ua.c b/src/ua.c
index 1299749750b7249b39a7c2a216b452dbfe3a7c7f..d5fc51ca9ab4a5c308a79a6e0f525117844ea42a 100755 (executable)
--- a/src/ua.c
+++ b/src/ua.c
@@ -1194,12 +1194,13 @@ int fota_blkid_update(void)
        char blk_name[PATH_MAX];
        char blk_name_previous[PATH_MAX];
        blkid_partlist pr = NULL;
+       blkid_probe bp = NULL;
 
        // new mode: use libblkid rather than reading partitions from
        // part_table configuration file.
        if (ua_slot_mode == 'a' || ua_slot_mode == 'b') {
                char ua_slot_mode_previous = ua_slot_mode == 'a' ? 'b' : 'a';
-               pr = get_part_list(blk_dev_arg);
+               pr = get_part_list(blk_dev_arg, &bp);
                if (!pr) {
                        return -1;
                }
@@ -1212,6 +1213,7 @@ int fota_blkid_update(void)
                                LOG("failed to get_part_number_by_name for: %s, slot: %c, %c (%d %d)",
                                                s_part_info[j].ua_parti_name, ua_slot_mode, ua_slot_mode_previous,
                                                id, id_previous);
+                               blkid_free_probe(bp);
                                return -1;
                        }
                        if (s_part_info[j].ua_blk_name) free(s_part_info[j].ua_blk_name);
@@ -1231,6 +1233,7 @@ int fota_blkid_update(void)
                                return -1;
                        }
                }
+               blkid_free_probe(bp);
        } else {
        // legacy mode: get part numbers from file
                memset((void*)part_tbl_path, 0x00, sizeof(part_tbl_path));