vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

script/execute.c: fix memory leak.

Browse source 
Make sure to continue loop over array after failure to free
allocated strings.

Found by: Coverity scan.
This commit is contained in:
Andrei Borzenkov 2015-01-28 20:35:28 +03:00
parent 2efab86d5a
commit 9883307a52
1 changed files with 66 additions and 46 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
grub-core/script/execute.c
View file

@ -635,11 +635,19 @@ grub_script_arglist_to_argv (struct grub_script_arglist *arglist,
{ {
case GRUB_SCRIPT_ARG_TYPE_VAR: case GRUB_SCRIPT_ARG_TYPE_VAR:
case GRUB_SCRIPT_ARG_TYPE_DQVAR: case GRUB_SCRIPT_ARG_TYPE_DQVAR:
{
int need_cleanup = 0;
values = grub_script_env_get (arg->str, arg->type); values = grub_script_env_get (arg->str, arg->type);
for (i = 0; values && values[i]; i++) for (i = 0; values && values[i]; i++)
{
if (!need_cleanup)
{ {
if (i != 0 && grub_script_argv_next (&result)) if (i != 0 && grub_script_argv_next (&result))
goto fail; {
need_cleanup = 1;
goto cleanup;
}
if (arg->type == GRUB_SCRIPT_ARG_TYPE_VAR) if (arg->type == GRUB_SCRIPT_ARG_TYPE_VAR)
{ {
@ -655,7 +663,10 @@ grub_script_arglist_to_argv (struct grub_script_arglist *arglist,
/* \ -> \\ */ /* \ -> \\ */
p = grub_malloc (len * 2 + 1); p = grub_malloc (len * 2 + 1);
if (! p) if (! p)
goto fail; {
need_cleanup = 1;
goto cleanup;
}
op = p; op = p;
while ((ch = *s++)) while ((ch = *s++))
@ -673,19 +684,28 @@ grub_script_arglist_to_argv (struct grub_script_arglist *arglist,
if (grub_script_argv_append (&result, p, op - p)) if (grub_script_argv_append (&result, p, op - p))
{ {
grub_free (p); grub_free (p);
goto fail; need_cleanup = 1;
/* Fall through to cleanup */
} }
} }
else else
{ {
if (append (&result, values[i], 1)) if (append (&result, values[i], 1))
goto fail; need_cleanup = 1;
/* Fall through to cleanup */
}
} }
cleanup:
grub_free (values[i]); grub_free (values[i]);
} }
grub_free (values); grub_free (values);
if (need_cleanup)
goto fail;
break; break;
}
case GRUB_SCRIPT_ARG_TYPE_BLOCK: case GRUB_SCRIPT_ARG_TYPE_BLOCK:
{ {