fs/squashfs: sqfs_probe: fix possible memory leak on error 83/250883/1
authorRichard Genoud <richard.genoud@posteo.net>
Tue, 3 Nov 2020 11:11:19 +0000 (12:11 +0100)
committerJaehoon Chung <jh80.chung@samsung.com>
Tue, 5 Jan 2021 07:10:53 +0000 (16:10 +0900)
If SquashFS magic number is invalid, there's a memory leak.

Reviewed-by: Joao Marcos Costa <jmcosta944@gmail.com>
Signed-off-by: Richard Genoud <richard.genoud@posteo.net>
[jh80.chung: cherry picked from mainline commit ccd4c08a452b3703ee16ba730a84b7caadcff97a]
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
Change-Id: I3be0a354f3407d13902c244580109eb0a9ff71e9

fs/squashfs/sqfs.c

index c816cd5..2e63039 100644 (file)
@@ -1093,8 +1093,8 @@ int sqfs_probe(struct blk_desc *fs_dev_desc, struct disk_partition *fs_partition
        /* Make sure it has a valid SquashFS magic number*/
        if (get_unaligned_le32(&sblk->s_magic) != SQFS_MAGIC_NUMBER) {
                printf("Bad magic number for SquashFS image.\n");
-               ctxt.cur_dev = NULL;
-               return -EINVAL;
+               ret = -EINVAL;
+               goto error;
        }
 
        ctxt.sblk = sblk;
@@ -1102,12 +1102,16 @@ int sqfs_probe(struct blk_desc *fs_dev_desc, struct disk_partition *fs_partition
        ret = sqfs_decompressor_init(&ctxt);
 
        if (ret) {
-               ctxt.cur_dev = NULL;
-               free(ctxt.sblk);
-               return -EINVAL;
+               ret = -EINVAL;
+               goto error;
        }
 
        return 0;
+error:
+       ctxt.cur_dev = NULL;
+       free(ctxt.sblk);
+       ctxt.sblk = NULL;
+       return ret;
 }
 
 static char *sqfs_basename(char *path)