diff mbox series

[03/10] libsframe: fix memory leak in sframe_decode

Message ID 20260827224146.3391610-4-ibhagatgnu@gmail.com
State New
Headers
Series fix two PRs and guard against bad data |

Checks

Context Check Description
linaro-tcwg-bot/tcwg_binutils_build--master-arm success Build passed
linaro-tcwg-bot/tcwg_binutils_build--master-aarch64 success Build passed
linaro-tcwg-bot/tcwg_binutils_check--master-aarch64 success Test passed
linaro-tcwg-bot/tcwg_binutils_check--master-arm success Test passed

Commit Message

Indu Bhagat Aug. 27, 2026, 10:41 p.m. UTC 
  From: Indu Bhagat <indu.bhagat@oracle.com>

If dctx is successfully allocated by malloc, but the subsequent malloc
for tempbuf fails, sframe_decode () immediately returns NULL without
freeing dctx.  This leaks the newly allocated sframe_decoder_ctx
structure.

Change the return on tempbuf == NULL to jump to decode_fail_free to
address this.
---
 libsframe/sframe.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Comments

Jens Remus Sept. 7, 2026, 12:03 p.m. UTC | #1 
On 8/28/2026 12:41 AM, Indu Bhagat wrote:
> From: Indu Bhagat <indu.bhagat@oracle.com>
> 
> If dctx is successfully allocated by malloc, but the subsequent malloc
> for tempbuf fails, sframe_decode () immediately returns NULL without
> freeing dctx.  This leaks the newly allocated sframe_decoder_ctx
> structure.
> 
> Change the return on tempbuf == NULL to jump to decode_fail_free to
> address this.
> ---
>  libsframe/sframe.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)

Reviewed-by: Jens Remus <jremus@linux.ibm.com>

> diff --git a/libsframe/sframe.c b/libsframe/sframe.c

> @@ -1448,7 +1448,10 @@ sframe_decode (const char *sf_buf, size_t sf_size, int *errp)
>        /* Allocate a new buffer and initialize it.  */
>        char *tempbuf = malloc (sf_size * sizeof (char));
>        if (tempbuf == NULL)
> -	return sframe_ret_set_errno (errp, SFRAME_ERR_NOMEM);
> +	{
> +	  sframe_ret_set_errno (errp, SFRAME_ERR_NOMEM);
> +	  goto decode_fail_free;
> +	}
>        memcpy (tempbuf, sf_buf, sf_size);
>  
>        /* Flip the header first.  */

Regards,
Jens
diff mbox series

Patch

diff --git a/libsframe/sframe.c b/libsframe/sframe.c
index 712dd0fdb68..d50a9e5689b 100644
--- a/libsframe/sframe.c
+++ b/libsframe/sframe.c
@@ -1448,7 +1448,10 @@  sframe_decode (const char *sf_buf, size_t sf_size, int *errp)
       /* Allocate a new buffer and initialize it.  */
       char *tempbuf = malloc (sf_size * sizeof (char));
       if (tempbuf == NULL)
-	return sframe_ret_set_errno (errp, SFRAME_ERR_NOMEM);
+	{
+	  sframe_ret_set_errno (errp, SFRAME_ERR_NOMEM);
+	  goto decode_fail_free;
+	}
       memcpy (tempbuf, sf_buf, sf_size);
 
       /* Flip the header first.  */