fs/squashfs: sqfs_split_path: fix memory leak and dangling pointers

*file and *dir were not freed on error

Reviewed-by: Joao Marcos Costa <jmcosta944@gmail.com>
Signed-off-by: Richard Genoud <richard.genoud@posteo.net>
[jh80.chung: cherry picked from mainline commit 5487477802e0ad7bfad046af25f4a04cfd98cb7a]
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
Change-Id: I185e3bb66f52d16eb02a2b2076aa723aab5cb753

diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
index 5b7a20a..092e7a4 100644 (file)
--- a/fs/squashfs/sqfs.c
+++ b/fs/squashfs/sqfs.c
@@ -1092,15 +1092,27 @@ static int sqfs_split_path(char **file, char **dir, const char *path)
        char *dirc, *basec, *bname, *dname, *tmp_path;
        int ret = 0;
 
+       *file = NULL;
+       *dir = NULL;
+       dirc = NULL;
+       basec = NULL;
+       bname = NULL;
+       dname = NULL;
+       tmp_path = NULL;
+
        /* check for first slash in path*/
        if (path[0] == '/') {
                tmp_path = strdup(path);
-               if (!tmp_path)
-                       return -ENOMEM;
+               if (!tmp_path) {
+                       ret = -ENOMEM;
+                       goto out;
+               }
        } else {
                tmp_path = malloc(strlen(path) + 2);
-               if (!tmp_path)
-                       return -ENOMEM;
+               if (!tmp_path) {
+                       ret = -ENOMEM;
+                       goto out;
+               }
                tmp_path[0] = '/';
                strcpy(tmp_path + 1, path);
        }
@@ -1109,13 +1121,13 @@ static int sqfs_split_path(char **file, char **dir, const char *path)
        dirc = strdup(tmp_path);
        if (!dirc) {
                ret = -ENOMEM;
-               goto free_tmp;
+               goto out;
        }
 
        basec = strdup(tmp_path);
        if (!basec) {
                ret = -ENOMEM;
-               goto free_dirc;
+               goto out;
        }
 
        dname = sqfs_dirname(dirc);
@@ -1125,14 +1137,14 @@ static int sqfs_split_path(char **file, char **dir, const char *path)
 
        if (!*file) {
                ret = -ENOMEM;
-               goto free_basec;
+               goto out;
        }
 
        if (*dname == '\0') {
                *dir = malloc(2);
                if (!*dir) {
                        ret = -ENOMEM;
-                       goto free_basec;
+                       goto out;
                }
 
                (*dir)[0] = '/';
@@ -1141,15 +1153,19 @@ static int sqfs_split_path(char **file, char **dir, const char *path)
                *dir = strdup(dname);
                if (!*dir) {
                        ret = -ENOMEM;
-                       goto free_basec;
+                       goto out;
                }
        }
 
-free_basec:
+out:
+       if (ret) {
+               free(*file);
+               free(*dir);
+               *dir = NULL;
+               *file = NULL;
+       }
        free(basec);
-free_dirc:
        free(dirc);
-free_tmp:
        free(tmp_path);
 
        return ret;