vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

tftp: fix memory leaks in open

Browse source 
If protocol open fails, file is immediately freed, so data was leaked.

Found by: Coverity scan.
CID: 96659
This commit is contained in:
Andrei Borzenkov 2016-01-16 21:27:57 +03:00
parent d4561cd080
commit 77002c65d3
1 changed files with 16 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
grub-core/net/tftp.c
View file

@ -326,7 +326,10 @@ tftp_open (struct grub_file *file, const char *filename)
grub_netbuff_reserve (&nb, 1500); grub_netbuff_reserve (&nb, 1500);
err = grub_netbuff_push (&nb, sizeof (*tftph)); err = grub_netbuff_push (&nb, sizeof (*tftph));
if (err) if (err)
{
grub_free (data);
return err; return err;
}
tftph = (struct tftphdr *) nb.data; tftph = (struct tftphdr *) nb.data;
@ -361,19 +364,26 @@ tftp_open (struct grub_file *file, const char *filename)
err = grub_netbuff_unput (&nb, nb.tail - (nb.data + hdrlen)); err = grub_netbuff_unput (&nb, nb.tail - (nb.data + hdrlen));
if (err) if (err)
{
grub_free (data);
return err; return err;
}
file->not_easily_seekable = 1; file->not_easily_seekable = 1;
file->data = data; file->data = data;
data->pq = grub_priority_queue_new (sizeof (struct grub_net_buff *), cmp); data->pq = grub_priority_queue_new (sizeof (struct grub_net_buff *), cmp);
if (!data->pq) if (!data->pq)
{
grub_free (data);
return grub_errno; return grub_errno;
}
err = grub_net_resolve_address (file->device->net->server, &addr); err = grub_net_resolve_address (file->device->net->server, &addr);
if (err) if (err)
{ {
destroy_pq (data); destroy_pq (data);
grub_free (data);
return err; return err;
} }
@ -383,6 +393,7 @@ tftp_open (struct grub_file *file, const char *filename)
if (!data->sock) if (!data->sock)
{ {
destroy_pq (data); destroy_pq (data);
grub_free (data);
return grub_errno; return grub_errno;
} }
@ -396,6 +407,7 @@ tftp_open (struct grub_file *file, const char *filename)
{ {
grub_net_udp_close (data->sock); grub_net_udp_close (data->sock);
destroy_pq (data); destroy_pq (data);
grub_free (data);
return err; return err;
} }
grub_net_poll_cards (GRUB_NET_INTERVAL + (i * GRUB_NET_INTERVAL_ADDITION), grub_net_poll_cards (GRUB_NET_INTERVAL + (i * GRUB_NET_INTERVAL_ADDITION),
@ -412,6 +424,7 @@ tftp_open (struct grub_file *file, const char *filename)
{ {
grub_net_udp_close (data->sock); grub_net_udp_close (data->sock);
destroy_pq (data); destroy_pq (data);
grub_free (data);
return grub_errno; return grub_errno;
} }