[PATCH 17/29] jffs2: fix a memleak in read_direntry()

Sebastian Huber sebastian.huber at embedded-brains.de
Thu Jul 5 07:49:37 UTC 2018


From: Wei Fang <fangwei1 at huawei.com>

Need to free the memory allocated for 'fd' if failed to read all
of the remainder name.

Signed-off-by: Wei Fang <fangwei1 at huawei.com>
Signed-off-by: Brian Norris <computersforpeace at gmail.com>

5	1	cpukit/libfs/src/jffs2/src/readinode.c

diff --git a/cpukit/libfs/src/jffs2/src/readinode.c b/cpukit/libfs/src/jffs2/src/readinode.c
index 69ab7709f8..ba1ad6a22f 100644
--- a/cpukit/libfs/src/jffs2/src/readinode.c
+++ b/cpukit/libfs/src/jffs2/src/readinode.c
@@ -669,8 +669,12 @@ static inline int read_direntry(struct jffs2_sb_info *c, struct jffs2_raw_node_r
 
 		err = jffs2_flash_read(c, (ref_offset(ref)) + read,
 				rd->nsize - already, &read, &fd->name[already]);
-		if (unlikely(read != rd->nsize - already) && likely(!err))
+		if (unlikely(read != rd->nsize - already) && likely(!err)) {
+			jffs2_free_full_dirent(fd);
+			JFFS2_ERROR("short read: wanted %d bytes, got %zd\n",
+				    rd->nsize - already, read);
 			return -EIO;
+		}
 
 		if (unlikely(err)) {
 			JFFS2_ERROR("read remainder of name: error %d\n", err);
-- 
2.13.7




More information about the devel mailing list