Changeset ae754e5f in mainline

Timestamp:

2011-10-31T10:44:12Z (13 years ago)

Author:

Jan Vesely <jano.vesely@…>

Branches:

lfn, master, serial, ticket/834-toolchain-update, topic/msim-upgrade, topic/simplify-dev-export

Children:

10059a68

Parents:

3562cd18

Message:

libusbdev: Fix memory leak and possible double free in error path.

We need child_fun to be valid pointer otherwise the ddf_fun create allocated
memory is unreachable.
ddf_fun_create str_dups name so free it asap.
It's driver_data that needs to be protected from free as we now nothing about that place in this function.

File:

• uspace/lib/usbdev/src/recognise.c (modified) (3 diffs)

uspace/lib/usbdev/src/recognise.c

@@ -350 +350 @@
     ddf_dev_ops_t *dev_ops, void *dev_data, ddf_fun_t **child_fun)
 {
+        if (child_fun == NULL)
+                return EINVAL;
+
         size_t this_device_name_index;
 
@@ -389 +392 @@
 
         child = ddf_fun_create(parent, fun_inner, child_name);
+        free(child_name);
         if (child == NULL) {
                 rc = ENOMEM;
@@ -412 +416 @@
         }
 
-        if (child_fun != NULL) {
-                *child_fun = child;
-        }
-
+        *child_fun = child;
         return EOK;
 
 failure:
         if (child != NULL) {
-                child->name = NULL;
+                /* This was not malloced by us, does not even have to be
+                 * on heap. */
+                child->driver_data = NULL;
                 /* This takes care of match_id deallocation as well. */
                 ddf_fun_destroy(child);
         }
-        if (child_name != NULL) {
-                free(child_name);
-        }
 
         return rc;