diff options
author | Stefan Kerkmann <s.kerkmann@pengutronix.de> | 2024-02-01 12:28:49 +0100 |
---|---|---|
committer | Sascha Hauer <s.hauer@pengutronix.de> | 2024-02-01 16:09:59 +0100 |
commit | dd36494ae2016924adf2c85d745a24830857723d (patch) | |
tree | 8e3e9e2fc2d87fdb01fa9a12edbf2c013f41392f /drivers/of/fdt.c | |
parent | eca34ec9b611b9ede7981f1c3d54b35e7f99bf8c (diff) | |
download | barebox-dd36494ae2016924adf2c85d745a24830857723d.tar.gz barebox-dd36494ae2016924adf2c85d745a24830857723d.tar.xz |
of: fdt: fix memory leak in fdt_ensure_space
If the reallocation failed the old memory remains allocated and is never
freed, this is fixed by freeing the old memory on error.
Signed-off-by: Stefan Kerkmann <s.kerkmann@pengutronix.de>
Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20240201-fix-fdt-memory-safety-v2-1-267b7b8813fd@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Diffstat (limited to 'drivers/of/fdt.c')
-rw-r--r-- | drivers/of/fdt.c | 28 |
1 files changed, 21 insertions, 7 deletions
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c index 5c21bab5de..544294a9ac 100644 --- a/drivers/of/fdt.c +++ b/drivers/of/fdt.c @@ -375,24 +375,38 @@ static void *memalign_realloc(void *orig, size_t oldsize, size_t newsize) static int fdt_ensure_space(struct fdt *fdt, int dtsize) { + size_t new_size; + void *previous; + /* * We assume strings and names have a maximum length of 1024 * whereas properties can be longer. We allocate new memory * if we have less than 1024 bytes (+ the property size left. */ if (fdt->str_size - fdt->str_nextofs < 1024) { - fdt->strings = realloc(fdt->strings, fdt->str_size * 2); - if (!fdt->strings) + previous = fdt->strings; + new_size = fdt->str_size * 2; + + fdt->strings = realloc(previous, new_size); + if (!fdt->strings) { + free(previous); return -ENOMEM; - fdt->str_size *= 2; + } + + fdt->str_size = new_size; } if (fdt->dt_size - fdt->dt_nextofs < 1024 + dtsize) { - fdt->dt = memalign_realloc(fdt->dt, fdt->dt_size, - fdt->dt_size * 2); - if (!fdt->dt) + previous = fdt->dt; + new_size = fdt->dt_size * 2; + + fdt->dt = memalign_realloc(previous, fdt->dt_size, new_size); + if (!fdt->dt) { + free(previous); return -ENOMEM; - fdt->dt_size *= 2; + } + + fdt->dt_size = new_size; } return 0; |