fs: fat: Fix possible double free of fatbuf
authorAndrew F. Davis <afd@ti.com>
Thu, 16 May 2019 14:34:31 +0000 (09:34 -0500)
committerTom Rini <trini@konsulko.com>
Tue, 28 May 2019 17:57:52 +0000 (13:57 -0400)
fat_itr_root() allocates fatbuf so we free it on the exit path, if
the function fails we should not free it, check the return value
and skip freeing if the function fails.

Signed-off-by: Andrew F. Davis <afd@ti.com>
fs/fat/fat.c

index c5997c2..06c8ed1 100644 (file)
@@ -1134,11 +1134,12 @@ int fat_size(const char *filename, loff_t *size)
                 * expected to fail if passed a directory path:
                 */
                free(fsdata.fatbuf);
-               fat_itr_root(itr, &fsdata);
-               if (!fat_itr_resolve(itr, filename, TYPE_DIR)) {
+               ret = fat_itr_root(itr, &fsdata);
+               if (ret)
+                       goto out_free_itr;
+               ret = fat_itr_resolve(itr, filename, TYPE_DIR);
+               if (!ret)
                        *size = 0;
-                       ret = 0;
-               }
                goto out_free_both;
        }