diff options
| author | Srinivas Kandagatla <srinivas.kandagatla@linaro.org> | 2019-08-27 18:30:01 +0100 |
|---|---|---|
| committer | Srinivas Kandagatla <srinivas.kandagatla@linaro.org> | 2019-08-28 13:25:46 +0100 |
| commit | 740cae0997103fafb58c4f3c73f419ba45f8c2f6 (patch) | |
| tree | acb8bf769d6dde3e988e03bc37b68d827cae1b1e | |
| parent | 7adc8f56212b6b3432cbd3f96363cd3abb527efb (diff) | |
fastrpc: apps_user: check args before freeing.
args pointer can be uninitalized before calling free.
Code path for this is via VERIFYC macro jumping to bail label
which is not very explicit from the code.
Fixes: 7797ba9cdbbb (apps_user: fix memory leak)
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
| -rw-r--r-- | src/fastrpc_apps_user.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/src/fastrpc_apps_user.c b/src/fastrpc_apps_user.c index a4c5c1f..ba76499 100644 --- a/src/fastrpc_apps_user.c +++ b/src/fastrpc_apps_user.c @@ -748,7 +748,7 @@ static int fdlist_fd_to_buf(void *buf) int remote_handle_invoke_domain(int domain, remote_handle handle, uint32_t sc, remote_arg* pra) { struct fastrpc_invoke invoke; - struct fastrpc_invoke_args *args; + struct fastrpc_invoke_args *args = NULL; int bufs, i, req, nErr = 0; int dev; VERIFY(dev != -1); @@ -795,7 +795,9 @@ int remote_handle_invoke_domain(int domain, remote_handle handle, uint32_t sc, r FARF(HIGH,"debug:sc:%x,handle:%x\n",sc,handle); nErr = ioctl(dev, req, (unsigned long)&invoke); bail: - free(args); + if (args) + free(args); + return nErr; } |