Hello!
Similar to mmap, I checked the code where malloc, calloc, and realloc
were called. In these places, variable values weren't checked for NULL
before being accessed.
Thanks,
--
Mikhail Karpov
From 501c2b093846ff22890d96e8d79db7d718d4976b Mon Sep 17 00:00:00 2001
From: Mikhail Karpov <[email protected]>
Date: Wed, 1 Jul 2026 20:40:59 +0700
Subject: [PATCH] Added checks for alloc return value in several places.
---
defpager/backing.c | 5 ++++
defpager/defpager.c | 17 +++++++++---
eth-multiplexer/netfs_impl.c | 22 +++++++++++----
ext2fs/dir.c | 15 +++++++++-
fatfs/fat.c | 3 ++
fatfs/pager.c | 3 ++
libbpf/bpf_impl.c | 4 +++
libdiskfs/file-chg.c | 7 +++++
libpager/lock-object.c | 1 +
libpager/object-init.c | 7 +++++
libpager/pager-attr.c | 1 +
libps/proclist.c | 6 +++-
libps/procstat.c | 5 ++++
libstore/remap.c | 9 +++++-
lwip/lwip-util.c | 9 +++++-
lwip/pfinet-ops.c | 8 ++++++
lwip/port/netif/ifcommon.c | 3 ++
lwip/socket-ops.c | 3 ++
mach-defpager/default_pager.c | 44 ++++++++++++++++++++++++++++++
nfs/ops.c | 3 ++
nfsd/cache.c | 6 ++++
nfsd/fsys.c | 18 +++++++++++-
nfsd/loop.c | 3 ++
nfsd/xdr.c | 2 ++
pfinet/glue-include/linux/kernel.h | 3 ++
pfinet/socket-ops.c | 3 ++
proc/mgt.c | 1 +
procfs/dircat.c | 15 +++++++++-
startup/startup.c | 9 ++++++
term/main.c | 3 ++
term/munge.c | 2 ++
term/users.c | 9 ++++++
trans/magic.c | 3 +-
trans/new-fifo.c | 1 +
trans/remap.c | 3 ++
utils/msgport.c | 8 ++++++
utils/ps.c | 2 ++
utils/settrans.c | 2 +-
38 files changed, 251 insertions(+), 17 deletions(-)
diff --git a/defpager/backing.c b/defpager/backing.c
index 56fe6551..14511004 100644
--- a/defpager/backing.c
+++ b/defpager/backing.c
@@ -50,6 +50,9 @@ init_backing (char *name)
bmap_len = backing_store->size / vm_page_size / NBBY;
bmap = malloc (bmap_len);
+ if (!bmap)
+ return ENOMEM;
+
for (i = 0; i < bmap_len; i++)
bmap[i] = 0xff;
bmap_rotor = bmap;
@@ -60,6 +63,8 @@ init_backing (char *name)
sure we don't tromp on the misfeature in Linux of using the first
page for permanent data. */
*bmap_rotor |= 1;
+
+ return 0;
}
int
diff --git a/defpager/defpager.c b/defpager/defpager.c
index 3b3cda1e..5f42fd98 100644
--- a/defpager/defpager.c
+++ b/defpager/defpager.c
@@ -33,7 +33,7 @@ struct user_pager_info
/* Expand the P->map as necessary to handle an incoming request of the
page at ADDR. */
-static inline void
+static inline error_t
expand_map (struct user_pager_info *p, vm_offset_t addr)
{
/* See if this is beyond the current extent */
@@ -44,11 +44,16 @@ expand_map (struct user_pager_info *p, vm_offset_t addr)
newsize = page + vm_page_size;
newmap = realloc (pager->map, size / vm_page_size * sizeof (off_t));
+ if (!newmap)
+ return ENOMEM;
- memset (pager->map + pager->size / vm_page_size * sizeof(off_t), 0, (newsize - pager->size) / vm_page_size * sizeof(off_t));
+ memset (pager->map + pager->size / vm_page_size * sizeof(off_t),
+ 0, (newsize - pager->size) / vm_page_size * sizeof(off_t));
pager->size = newsize;
pager->map = newmap;
}
+
+ return 0;
}
error_t
@@ -63,7 +68,9 @@ pager_read_page (struct user_pager_info *pager,
/* We never request write locks. */
*write_lock = 0;
- expand_map (pager, page);
+ error_t err = expand_map (pager, page);
+ if (err)
+ return err;
if (!pager->map[pfn])
vm_allocate (mach_task_self (), buf, vm_page_size, 1);
@@ -89,7 +96,9 @@ pager_write_page (struct user_pager_info *pager,
int pfn = page / vm_page_size;
size_t nwritten;
- expand_map (pager, page);
+ error_t err = expand_map (pager, page);
+ if (err)
+ return err;
if (!pager->map[pfn])
pager->map[pfn] = allocate_backing_page ();
diff --git a/eth-multiplexer/netfs_impl.c b/eth-multiplexer/netfs_impl.c
index 83a23132..1350616d 100644
--- a/eth-multiplexer/netfs_impl.c
+++ b/eth-multiplexer/netfs_impl.c
@@ -80,26 +80,31 @@ new_node (struct lnode *ln, struct node **np)
return err;
}
-struct node *
-lookup (const char *name)
+static error_t
+lookup (struct node **node, const char *name)
{
struct lnode *ln = (struct lnode *) lookup_dev_by_name (name);
char *copied_name = malloc (strlen (name) + 1);
+ if (!copied_name)
+ return ENOMEM;
+
strcpy (copied_name, name);
if (ln)
{
new_node (ln, &ln->n);
ln->n->nn->name = copied_name;
- return ln->n;
+ *node = ln->n;
}
else
{
struct node *n;
new_node (ln, &n);
n->nn->name = copied_name;
- return n;
+ *node = n;
}
+
+ return 0;
}
/* Attempt to create a file named NAME in DIR for USER with MODE. Set *NODE
@@ -304,7 +309,14 @@ error_t netfs_attempt_lookup (struct iouser *user, struct node *dir,
return err;
}
- *node = lookup (name);
+ err = lookup (node, name);
+ if (err)
+ {
+ *node = NULL;
+ pthread_mutex_unlock (&dir->lock);
+ return err;
+ }
+
pthread_mutex_lock (&(*node)->lock);
pthread_mutex_unlock (&dir->lock);
return 0;
diff --git a/ext2fs/dir.c b/ext2fs/dir.c
index 55f26579..051540cf 100644
--- a/ext2fs/dir.c
+++ b/ext2fs/dir.c
@@ -493,6 +493,9 @@ dirscanblock (vm_address_t blockaddr, struct node *dp, int idx,
{
diskfs_node_disknode (dp)->dirents =
malloc ((dp->dn_stat.st_size / DIRBLKSIZ) * sizeof (int));
+ if (!diskfs_node_disknode (dp)->dirents)
+ return ENOMEM;
+
for (i = 0; i < dp->dn_stat.st_size/DIRBLKSIZ; i++)
diskfs_node_disknode (dp)->dirents[i] = -1;
}
@@ -687,9 +690,13 @@ diskfs_direnter_hard (struct node *dp, const char *name, struct node *np,
anything at all. */
if (diskfs_node_disknode (dp)->dirents)
{
- diskfs_node_disknode (dp)->dirents =
+ int *new_dirents =
realloc (diskfs_node_disknode (dp)->dirents,
(dp->dn_stat.st_size / DIRBLKSIZ * sizeof (int)));
+ if (!new_dirents)
+ return ENOMEM;
+
+ diskfs_node_disknode (dp)->dirents = new_dirents;
for (i = oldsize / DIRBLKSIZ;
i < dp->dn_stat.st_size / DIRBLKSIZ;
i++)
@@ -701,6 +708,9 @@ diskfs_direnter_hard (struct node *dp, const char *name, struct node *np,
{
diskfs_node_disknode (dp)->dirents =
malloc (dp->dn_stat.st_size / DIRBLKSIZ * sizeof (int));
+ if (!diskfs_node_disknode (dp)->dirents)
+ return ENOMEM;
+
for (i = 0; i < dp->dn_stat.st_size / DIRBLKSIZ; i++)
diskfs_node_disknode (dp)->dirents[i] = -1;
diskfs_node_disknode (dp)->dirents[ds->idx] = 1;
@@ -907,6 +917,9 @@ diskfs_get_directs (struct node *dp,
if (!diskfs_node_disknode (dp)->dirents)
{
diskfs_node_disknode (dp)->dirents = malloc (nblks * sizeof (int));
+ if (!diskfs_node_disknode (dp)->dirents)
+ return ENOMEM;
+
for (i = 0; i < nblks; i++)
diskfs_node_disknode (dp)->dirents[i] = -1;
}
diff --git a/fatfs/fat.c b/fatfs/fat.c
index e765376d..4af321c6 100644
--- a/fatfs/fat.c
+++ b/fatfs/fat.c
@@ -72,6 +72,9 @@ fat_read_sblock (void)
size_t read = sizeof(struct boot_sector);
sblock = malloc (read);
+ if (!sblock)
+ error (1, ENOMEM, "Failed to allocate memory for superblock.");
+
err = store_read (store, 0, read, (void **) &sblock, &read);
if (err)
error (1, err, "Could not read superblock");
diff --git a/fatfs/pager.c b/fatfs/pager.c
index e2302cec..c56f9f56 100644
--- a/fatfs/pager.c
+++ b/fatfs/pager.c
@@ -776,6 +776,9 @@ create_fat_pager (void)
/* The disk pager. */
struct user_pager_info *upi = malloc (sizeof (struct user_pager_info));
+ if (!upi)
+ error (2, ENOMEM, "Failed to allocate memory for user_pager_info.");
+
upi->type = FAT;
disk_pager_bucket = ports_create_bucket ();
diskfs_start_disk_pager (upi, disk_pager_bucket, MAY_CACHE, 0,
diff --git a/libbpf/bpf_impl.c b/libbpf/bpf_impl.c
index c78176c2..38d71aba 100644
--- a/libbpf/bpf_impl.c
+++ b/libbpf/bpf_impl.c
@@ -612,6 +612,8 @@ net_set_filter(if_filter_list_t *ifp, mach_port_t rcv_port, int priority,
* a normal packet filter structure.
*/
my_infp = (net_rcv_port_t) calloc(1, sizeof(struct net_rcv_port));
+ if (!my_infp)
+ return (D_NO_MEMORY);
my_infp->rcv_port = rcv_port;
is_new_infp = TRUE;
} else {
@@ -622,6 +624,8 @@ net_set_filter(if_filter_list_t *ifp, mach_port_t rcv_port, int priority,
*/
my_infp = 0;
hash_entp = (net_hash_entry_t) calloc(1, sizeof(struct net_hash_entry));
+ if (!hash_entp)
+ return (D_NO_MEMORY);
is_new_infp = FALSE;
}
diff --git a/libdiskfs/file-chg.c b/libdiskfs/file-chg.c
index 18170c25..40d1a4ed 100644
--- a/libdiskfs/file-chg.c
+++ b/libdiskfs/file-chg.c
@@ -43,7 +43,14 @@ diskfs_S_file_notice_changes (struct protid *cred, mach_port_t notify)
pthread_mutex_unlock (&np->lock);
return err;
}
+
req = malloc (sizeof (struct modreq));
+ if (!req)
+ {
+ pthread_mutex_unlock (&np->lock);
+ return ENOMEM;
+ }
+
req->port = notify;
req->next = np->filemod_reqs;
np->filemod_reqs = req;
diff --git a/libpager/lock-object.c b/libpager/lock-object.c
index d8a4c1f8..01114ee2 100644
--- a/libpager/lock-object.c
+++ b/libpager/lock-object.c
@@ -52,6 +52,7 @@ _pager_lock_object (struct pager *p,
if (!lr)
{
lr = malloc (sizeof (struct lock_request));
+ assert_backtrace (lr);
lr->start = offset;
lr->end = offset + size;
lr->pending_writes = 0;
diff --git a/libpager/object-init.c b/libpager/object-init.c
index 619d28f3..87b55f46 100644
--- a/libpager/object-init.c
+++ b/libpager/object-init.c
@@ -43,6 +43,13 @@ _pager_S_memory_object_init (struct pager *p,
{
#ifdef KERNEL_INIT_RACE
struct pending_init *i = malloc (sizeof (struct pending_init));
+ if (!i)
+ {
+ printf ("failed to allocate memory for pending_init");
+ pthread_mutex_unlock (&p->interlock);
+ return ENOMEM;
+ }
+
printf ("pager out-of-sequence init\n");
i->control = control;
i->name = name;
diff --git a/libpager/pager-attr.c b/libpager/pager-attr.c
index 4280e26d..66c9b61f 100644
--- a/libpager/pager-attr.c
+++ b/libpager/pager-attr.c
@@ -65,6 +65,7 @@ pager_change_attributes (struct pager *p,
if (!ar)
{
ar = malloc (sizeof (struct attribute_request));
+ assert_backtrace (ar);
ar->may_cache = may_cache;
ar->copy_strategy = copy_strategy;
ar->attrs_pending = 1;
diff --git a/libps/proclist.c b/libps/proclist.c
index e1ce4c16..bbbe03a5 100644
--- a/libps/proclist.c
+++ b/libps/proclist.c
@@ -124,7 +124,11 @@ proc_stat_list_add_pids (struct proc_stat_list *pp,
struct proc_stat **end = pp->proc_stats + pp->num_procs;
if (proc_stats)
- *proc_stats = NEWVEC (struct proc_stat *, num_procs);
+ {
+ *proc_stats = NEWVEC (struct proc_stat *, num_procs);
+ if (!*proc_stats)
+ return ENOMEM;
+ }
for (i = 0; i < num_procs; i++)
{
diff --git a/libps/procstat.c b/libps/procstat.c
index 4de4216d..ae01b2f4 100644
--- a/libps/procstat.c
+++ b/libps/procstat.c
@@ -204,6 +204,11 @@ merge_procinfo (struct proc_stat *ps, ps_flags_t need, ps_flags_t have)
ps->thread_waits = malloc (WAITS_MALLOC_SIZE);
ps->thread_waits_len = WAITS_MALLOC_SIZE;
ps->thread_waits_vm_alloced = 0;
+ if (! ps->thread_waits)
+ {
+ free (new_pi);
+ return ENOMEM;
+ }
}
new_waits = ps->thread_waits;
new_waits_len = ps->thread_waits_len;
diff --git a/libstore/remap.c b/libstore/remap.c
index bbe78509..82fae2fd 100644
--- a/libstore/remap.c
+++ b/libstore/remap.c
@@ -317,7 +317,14 @@ store_remap_runs (const struct store_run *runs, size_t num_runs,
}
if (xruns_alloced > *num_xruns)
- *xruns = realloc (*xruns, *num_xruns * sizeof (struct store_run));
+ {
+ void *new_xruns = realloc (*xruns, *num_xruns
+ * sizeof (struct store_run));
+ if (!new_xruns)
+ ERR (ENOMEM);
+
+ xruns = new_xruns;
+ }
return 0;
}
diff --git a/lwip/lwip-util.c b/lwip/lwip-util.c
index c265ad6a..304e3648 100644
--- a/lwip/lwip-util.c
+++ b/lwip/lwip-util.c
@@ -150,7 +150,10 @@ init_ifs (void *arg)
int i;
if (netif_list == 0)
- netif_list = calloc (1, sizeof (struct netif));
+ {
+ netif_list = calloc (1, sizeof (struct netif));
+ assert_backtrace (netif_list);
+ }
if (netif_list->next == 0)
init_loopback ();
@@ -186,6 +189,7 @@ init_ifs (void *arg)
continue;
netif = calloc (1, sizeof (struct netif));
+ assert_backtrace (netif);
create_netif_state (in->dev_name, &ifc);
@@ -373,6 +377,9 @@ configure_device (struct netif *netif, uint32_t addr, uint32_t netmask,
{
/* Call update_if() inside the tcpip_thread */
struct update_if_args *arg = calloc (1, sizeof (struct update_if_args));
+ if (!arg)
+ return ENOMEM;
+
arg->netif = netif;
arg->addr = addr;
arg->netmask = netmask;
diff --git a/lwip/pfinet-ops.c b/lwip/pfinet-ops.c
index e87cfe0d..e83122fe 100644
--- a/lwip/pfinet-ops.c
+++ b/lwip/pfinet-ops.c
@@ -106,6 +106,9 @@ lwip_S_pfinet_siocgifconf (io_t port,
void *buf = mmap (0, amount, PROT_READ | PROT_WRITE,
MAP_ANON, 0, 0);
if (buf == MAP_FAILED)
+ /* Should check whether errno is indeed ENOMEM --
+ but this can't be done in a straightforward way,
+ because the glue headers #undef errno. */
return ENOMEM;
ifc.ifc_buf = buf;
@@ -206,6 +209,8 @@ lwip_S_pfinet_getroutes (io_t port,
*dealloc_data = FALSE;
rtable = calloc (MAX_ROUTES, sizeof (ifrtreq_t));
+ if (!rtable)
+ return ENOMEM;
available_count = get_routes (rtable);
@@ -228,6 +233,9 @@ lwip_S_pfinet_getroutes (io_t port,
if (*routes == MAP_FAILED)
{
+ /* Should check whether errno is indeed ENOMEM --
+ but this can't be done in a straightforward way,
+ because the glue headers #undef errno. */
*len = 0;
return ENOMEM;
}
diff --git a/lwip/port/netif/ifcommon.c b/lwip/port/netif/ifcommon.c
index cc4290a0..a86c4edf 100644
--- a/lwip/port/netif/ifcommon.c
+++ b/lwip/port/netif/ifcommon.c
@@ -156,6 +156,9 @@ if_change_flags (struct netif * netif, uint16_t flags)
*/
struct if_change_flags_args *args =
calloc (1, sizeof (struct if_change_flags_args));
+ if (!args)
+ return ENOMEM;
+
args->netif = netif;
args->flags = flags;
err = tcpip_callback_wait(_if_change_flags, args);
diff --git a/lwip/socket-ops.c b/lwip/socket-ops.c
index 55f5a606..b422f289 100644
--- a/lwip/socket-ops.c
+++ b/lwip/socket-ops.c
@@ -291,6 +291,9 @@ lwip_S_socket_whatis_address (struct sock_addr * addr,
void *buf = mmap (0, addr->address.sa.sa_len, PROT_READ | PROT_WRITE,
MAP_ANON, 0, 0);
if (buf == MAP_FAILED)
+ /* Should check whether errno is indeed ENOMEM --
+ but this can't be done in a straightforward way,
+ because the glue headers #undef errno. */
return ENOMEM;
*data = buf;
diff --git a/mach-defpager/default_pager.c b/mach-defpager/default_pager.c
index e55fa642..813a0a53 100644
--- a/mach-defpager/default_pager.c
+++ b/mach-defpager/default_pager.c
@@ -188,13 +188,20 @@ new_partition (const char *name, struct file_direct *fdp,
bmsize = howmany(size, NB_BM) * sizeof(bm_entry_t);
part = (partition_t) malloc(sizeof(struct part));
+ if (!part)
+ panic("(default pager): failed to allocate memory for part");
pthread_mutex_init(&part->p_lock, NULL);
part->name = (char*) malloc(n + 1);
+ if (!part->name)
+ panic("(default pager): failed to allocate memory for part->name");
strcpy(part->name, name);
part->total_size = size;
part->free = size;
part->id = id;
part->bitmap = (bm_entry_t *)malloc(bmsize);
+ if (!part->bitmap)
+ panic("(default pager): "
+ "failed to allocate memory for part->bitmap");
part->going_away= FALSE;
part->file = fdp;
@@ -633,6 +640,8 @@ dp_map_t pager_get_direct_map(dpager_t pager)
}
mapptr = (dp_map_t) malloc(alloc_size);
+ if (!mapptr)
+ panic("(default pager): failed to allocate memory for mapptr");
for (emapptr = &mapptr[(alloc_size-1) / sizeof(vm_offset_t)];
emapptr >= mapptr;
emapptr--)
@@ -683,10 +692,16 @@ pager_alloc(dpager_t pager,
if (INDIRECT_PAGEMAP(size)) {
mapptr = (vm_offset_t *)
malloc(INDIRECT_PAGEMAP_SIZE(size));
+ if (!mapptr)
+ panic("(default pager): "
+ "failed to allocate memory for mapptr");
for (i = INDIRECT_PAGEMAP_ENTRIES(size); --i >= 0;)
mapptr[i] = 0;
} else {
mapptr = (vm_offset_t *) malloc(PAGEMAP_SIZE(size));
+ if (!mapptr)
+ panic("(default pager): "
+ "failed to allocate memory for mapptr");
for (i = 0; i < size; i++)
mapptr[i] = NO_CHECKSUM;
}
@@ -828,6 +843,9 @@ pager_extend(dpager_t pager,
*/
new_mapptr = (dp_map_t)
malloc(INDIRECT_PAGEMAP_SIZE(new_size));
+ if (!new_mapptr)
+ panic("(default pager): "
+ "failed to allocate memory for new_mapptr");
old_mapptr = pager_get_direct_map(pager);
for (i = 0; i < INDIRECT_PAGEMAP_ENTRIES(old_size); i++)
new_mapptr[i] = old_mapptr[i];
@@ -839,6 +857,9 @@ pager_extend(dpager_t pager,
#ifdef CHECKSUM
new_mapptr = (vm_offset_t *)
malloc(INDIRECT_PAGEMAP_SIZE(new_size));
+ if (!new_mapptr)
+ panic("(default pager): "
+ "failed to allocate memory for new_mapptr");
old_mapptr = pager->checksum;
for (i = 0; i < INDIRECT_PAGEMAP_ENTRIES(old_size); i++)
new_mapptr[i] = old_mapptr[i];
@@ -873,6 +894,9 @@ pager_extend(dpager_t pager,
* Allocate new second-level map first.
*/
new_mapptr = (dp_map_t) malloc(PAGEMAP_SIZE(PAGEMAP_ENTRIES));
+ if (!new_mapptr)
+ panic("(default pager): "
+ "failed to allocate memory for new_mapptr");
old_mapptr = pager_get_direct_map(pager);
for (i = 0; i < old_size; i++)
new_mapptr[i] = old_mapptr[i];
@@ -894,6 +918,9 @@ pager_extend(dpager_t pager,
*/
new_mapptr = (dp_map_t)
malloc(INDIRECT_PAGEMAP_SIZE(new_size));
+ if (!new_mapptr)
+ panic("(default pager): "
+ "failed to allocate memory for new_mapptr");
new_mapptr[0].indirect = old_mapptr;
for (i = 1; i < INDIRECT_PAGEMAP_ENTRIES(new_size); i++)
new_mapptr[i].indirect = 0;
@@ -904,6 +931,9 @@ pager_extend(dpager_t pager,
* Allocate new second-level map first.
*/
new_mapptr = (vm_offset_t *)malloc(PAGEMAP_SIZE(PAGEMAP_ENTRIES));
+ if (!new_mapptr)
+ panic("(default pager): "
+ "failed to allocate memory for new_mapptr");
old_mapptr = pager->checksum;
for (i = 0; i < old_size; i++)
new_mapptr[i] = old_mapptr[i];
@@ -917,6 +947,9 @@ pager_extend(dpager_t pager,
*/
new_mapptr = (vm_offset_t *)
malloc(INDIRECT_PAGEMAP_SIZE(new_size));
+ if (!new_mapptr)
+ panic("(default pager): "
+ "failed to allocate memory for new_mapptr");
new_mapptr[0] = (vm_offset_t) old_mapptr;
for (i = 1; i < INDIRECT_PAGEMAP_ENTRIES(new_size); i++)
new_mapptr[i] = 0;
@@ -932,6 +965,9 @@ pager_extend(dpager_t pager,
* Enlarging a direct block.
*/
new_mapptr = (dp_map_t) malloc(PAGEMAP_SIZE(new_size));
+ if (!new_mapptr)
+ panic("(default pager): "
+ "failed to allocate memory for new_mapptr");
old_mapptr = pager_get_direct_map(pager);
for (i = 0; i < old_size; i++)
new_mapptr[i] = old_mapptr[i];
@@ -943,6 +979,9 @@ pager_extend(dpager_t pager,
#ifdef CHECKSUM
new_mapptr = (vm_offset_t *)
malloc(PAGEMAP_SIZE(new_size));
+ if (!new_mapptr)
+ panic("(default pager): "
+ "failed to allocate memory for new_mapptr");
old_mapptr = pager->checksum;
for (i = 0; i < old_size; i++)
new_mapptr[i] = old_mapptr[i];
@@ -1021,6 +1060,9 @@ pager_truncate(dpager_t pager, vm_size_t new_size) /* in pages */
{
const dp_map_t old_mapptr = pager->map;
pager->map = (dp_map_t) malloc (INDIRECT_PAGEMAP_SIZE(new_size));
+ if (!pager->map)
+ panic("(default pager): "
+ "failed to allocate memory for pager->map");
memcpy (pager->map, old_mapptr, INDIRECT_PAGEMAP_SIZE(new_size));
free ((char *) old_mapptr);
}
@@ -1042,6 +1084,8 @@ pager_truncate(dpager_t pager, vm_size_t new_size) /* in pages */
/* Now reduce the size of the direct map itself. */
const dp_map_t old_mapptr = pager->map;
pager->map = (dp_map_t) malloc (PAGEMAP_SIZE (new_size));
+ if (!pager->map)
+ panic("(default pager): failed to allocate memory for pager->map");
memcpy (pager->map, old_mapptr, PAGEMAP_SIZE (new_size));
free ((char *) old_mapptr);
}
diff --git a/nfs/ops.c b/nfs/ops.c
index affdd931..c5100354 100644
--- a/nfs/ops.c
+++ b/nfs/ops.c
@@ -2090,6 +2090,9 @@ netfs_attempt_mksymlink (struct iouser *cred,
free (np->nn->transarg.name);
np->nn->transarg.name = malloc (strlen (arg) + 1);
+ if (!np->nn->transarg.name)
+ return ENOMEM;
+
strcpy (np->nn->transarg.name, arg);
np->nn->dtrans = SYMLINK;
np->nn->stat_updated = 0;
diff --git a/nfsd/cache.c b/nfsd/cache.c
index 864739c0..f13a8ca5 100644
--- a/nfsd/cache.c
+++ b/nfsd/cache.c
@@ -106,10 +106,13 @@ idspec_lookup (int nuids, int ngids, int *uids, int *gids)
assert_backtrace (sizeof (uid_t) == sizeof (int));
i = malloc (sizeof (struct idspec));
+ assert_backtrace (i);
i->nuids = nuids;
i->ngids = ngids;
i->uids = malloc (nuids * sizeof (uid_t));
i->gids = malloc (ngids * sizeof (gid_t));
+ assert_backtrace (i->uids);
+ assert_backtrace (i->gids);
memcpy (i->uids, uids, nuids * sizeof (uid_t));
memcpy (i->gids, gids, ngids * sizeof (gid_t));
i->references = 1;
@@ -304,6 +307,7 @@ lookup_cache_handle (int *p, struct cache_handle **cp, struct idspec *i)
}
c = malloc (sizeof (struct cache_handle));
+ assert_backtrace (c);
memcpy (c->handle.array, p, NFS2_FHSIZE);
cred_ref (i);
c->ids = i;
@@ -448,6 +452,7 @@ create_cached_handle (int fs, struct cache_handle *credc, file_t userport)
/* Create it anew. */
c = malloc (sizeof (struct cache_handle));
+ assert_backtrace (c);
memcpy (c->handle.array, fhandle.array, NFS2_FHSIZE);
cred_ref (credc->ids);
c->ids = credc->ids;
@@ -498,6 +503,7 @@ check_cached_replies (int xid,
}
cr = malloc (sizeof (struct cached_reply));
+ assert_backtrace (cr);
pthread_mutex_init (&cr->lock, NULL);
pthread_mutex_lock (&cr->lock);
memcpy (&cr->source, sender, sizeof (struct sockaddr_in));
diff --git a/nfsd/fsys.c b/nfsd/fsys.c
index f7467165..def443e2 100644
--- a/nfsd/fsys.c
+++ b/nfsd/fsys.c
@@ -24,6 +24,7 @@
#include <hurd.h>
#include <fcntl.h>
#include <string.h>
+#include <assert-backtrace.h>
#include "nfsd.h"
@@ -54,6 +55,12 @@ init_filesystems (void)
fsystable = (struct fsys_spec *) malloc ((fsystablesize = 10)
* sizeof (struct fsys_spec));
+ if (!fsystable)
+ {
+ error (0, ENOMEM, "Failed to allocate memory for fsystable");
+ return;
+ }
+
for (i = 0; i < fsystablesize; i++)
{
fsystable[i].fsys = MACH_PORT_NULL;
@@ -96,8 +103,15 @@ init_filesystems (void)
if (index >= fsystablesize)
{
- fsystable = (struct fsys_spec *)
+ void *new_fsystable =
realloc (fsystable, index * 2 * sizeof (struct fsys_spec));
+ if (!new_fsystable)
+ {
+ error (0, ENOMEM, "Cannot reallocate memory for fsystable");
+ return;
+ }
+
+ fsystable = new_fsystable;
for (i = fsystablesize; i < index * 2; i++)
{
fsystable[i].fsys = MACH_PORT_NULL;
@@ -190,6 +204,7 @@ enter_filesystem (char *name, file_t root)
fsystable = (struct fsys_spec *) realloc (fsystable,
(fsystablesize * 2)
* sizeof (struct fsys_spec));
+ assert_backtrace (fsystable);
for (i = fsystablesize; i < fsystablesize * 2; i++)
{
fsystable[i].fsys = MACH_PORT_NULL;
@@ -199,6 +214,7 @@ enter_filesystem (char *name, file_t root)
}
fsystable[nfsys].name = malloc (strlen (name) + 1);
+ assert_backtrace (fsystable[nfsys].name);
strcpy (fsystable[nfsys].name, name);
file_getcontrol (root, &fsystable[nfsys].fsys);
nfsys++;
diff --git a/nfsd/loop.c b/nfsd/loop.c
index 8e3ab251..386a9043 100644
--- a/nfsd/loop.c
+++ b/nfsd/loop.c
@@ -20,6 +20,7 @@
#include <string.h>
#include <fcntl.h>
+#include <assert-backtrace.h>
#include "nfsd.h"
@@ -81,6 +82,7 @@ server_loop (void *arg)
goto repost_reply;
r = (int *) (rbuf = malloc (MAXIOSIZE));
+ assert_backtrace (r);
if (ntohl (*p) != RPC_MSG_VERSION)
{
@@ -177,6 +179,7 @@ server_loop (void *arg)
{
free (rbuf);
r = (int *) (rbuf = malloc (amt));
+ assert_backtrace (r);
}
}
diff --git a/nfsd/xdr.c b/nfsd/xdr.c
index 8b175595..c40dc1ed 100644
--- a/nfsd/xdr.c
+++ b/nfsd/xdr.c
@@ -23,6 +23,7 @@
#include <sys/stat.h>
#include <sys/statfs.h>
#include <string.h>
+#include <assert-backtrace.h>
#include "nfsd.h"
/* Any better ideas? */
@@ -96,6 +97,7 @@ decode_name (int *p, char **name)
len = ntohl (*p);
p++;
*name = malloc (len + 1);
+ assert_backtrace (*name);
memcpy (*name, p, len);
(*name)[len] = '\0';
return p + INTSIZE (len);
diff --git a/pfinet/glue-include/linux/kernel.h b/pfinet/glue-include/linux/kernel.h
index 62ba2ff1..e34c0a77 100644
--- a/pfinet/glue-include/linux/kernel.h
+++ b/pfinet/glue-include/linux/kernel.h
@@ -46,6 +46,9 @@ static inline int
getname (const char *name, char **newp)
{
*newp = malloc (strlen (name) + 1);
+ if (!*newp)
+ return ENOMEM;
+
strcpy (*newp, name);
return 0;
}
diff --git a/pfinet/socket-ops.c b/pfinet/socket-ops.c
index ff2e82bb..5c587faa 100644
--- a/pfinet/socket-ops.c
+++ b/pfinet/socket-ops.c
@@ -349,6 +349,9 @@ S_socket_whatis_address (struct sock_addr *addr,
void *new_data = mmap (0, addr->address.sa_len, PROT_READ|PROT_WRITE,
MAP_ANON, 0, 0);
if (new_data == MAP_FAILED)
+ /* Should check whether errno is indeed ENOMEM --
+ but this can't be done in a straightforward way,
+ because the glue headers #undef errno. */
return ENOMEM;
*data = new_data;
diff --git a/proc/mgt.c b/proc/mgt.c
index dcb619af..05af823f 100644
--- a/proc/mgt.c
+++ b/proc/mgt.c
@@ -885,6 +885,7 @@ complete_proc (struct proc *p, pid_t pid)
if (!nulllogin)
{
nulllogin = malloc (sizeof (struct login) + sizeof (nullsname) + 1);
+ assert_backtrace (nulllogin);
nulllogin->l_refcnt = 1;
strcpy (nulllogin->l_name, nullsname);
}
diff --git a/procfs/dircat.c b/procfs/dircat.c
index 5a60899a..c257927c 100644
--- a/procfs/dircat.c
+++ b/procfs/dircat.c
@@ -36,6 +36,8 @@ dircat_get_contents (void *hook, char **contents, ssize_t *contents_len)
pos = 0;
*contents = malloc (sz = 512);
+ if (!*contents)
+ return ENOMEM;
for (i=0; i < dcn->num_dirs; i++)
{
@@ -53,8 +55,19 @@ dircat_get_contents (void *hook, char **contents, ssize_t *contents_len)
return err;
}
+ char *new_contents;
while (pos + sublen > sz)
- *contents = realloc (*contents, sz *= 2);
+ {
+ new_contents = realloc (*contents, sz *= 2);
+ if (!new_contents)
+ {
+ free (*contents);
+ *contents = NULL;
+ return ENOMEM;
+ }
+
+ *contents = new_contents;
+ }
memcpy (*contents + pos, subcon, sublen);
pos += sublen;
diff --git a/startup/startup.c b/startup/startup.c
index fe409f5c..8aa078af 100644
--- a/startup/startup.c
+++ b/startup/startup.c
@@ -1586,10 +1586,19 @@ S_startup_request_notification (mach_port_t server,
calls; this is important. We need later notification requests
to get executed first. */
nt = malloc (sizeof (struct ntfy_task));
+ if (!nt)
+ return ENOMEM;
+
nt->notify_port = notify;
nt->next = ntfy_tasks;
ntfy_tasks = nt;
nt->name = malloc (strlen (name) + 1);
+ if (!nt->name)
+ {
+ free (nt);
+ return ENOMEM;
+ }
+
strcpy (nt->name, name);
return 0;
}
diff --git a/term/main.c b/term/main.c
index 99ce2c66..9c1d807d 100644
--- a/term/main.c
+++ b/term/main.c
@@ -132,6 +132,9 @@ parse_opt (int opt, char *arg, struct argp_state *state)
case ARGP_KEY_INIT:
state->hook = calloc (1, sizeof *v);
+ if (!state->hook)
+ argp_failure (state, ENOMEM, 0, "Failed to allocate memory for"
+ " state->hook");
break;
case ARGP_KEY_FINI:
free (v);
diff --git a/term/munge.c b/term/munge.c
index 0903dd03..ca27ac15 100644
--- a/term/munge.c
+++ b/term/munge.c
@@ -752,6 +752,8 @@ reallocate_queue (struct queue *q)
/* Make the queue twice as large. */
newq = malloc (sizeof (struct queue)
+ q->arraylen * 2 * sizeof (quoted_char));
+ assert_backtrace (newq);
+
newq->susp = q->susp;
newq->lowat = q->lowat;
newq->hiwat = q->hiwat;
diff --git a/term/users.c b/term/users.c
index 629534ff..de8b4239 100644
--- a/term/users.c
+++ b/term/users.c
@@ -445,6 +445,8 @@ S_term_open_ctty (struct trivfs_protid *cred,
if (!err)
{
struct protid_hook *hook = malloc (sizeof (struct protid_hook));
+ if (!hook)
+ return ENOMEM;
hook->pid = pid;
hook->pgrp = pgrp;
@@ -1938,7 +1940,14 @@ trivfs_S_io_async (struct trivfs_protid *cred,
pthread_mutex_unlock (&global_lock);
return EBADF;
}
+
ar = malloc (sizeof (struct async_req));
+ if (!ar)
+ {
+ pthread_mutex_unlock (&global_lock);
+ return ENOMEM;
+ }
+
ar->notify = notify;
ar->next = async_requests;
async_requests = ar;
diff --git a/trans/magic.c b/trans/magic.c
index 73fdaea3..d7e4146a 100644
--- a/trans/magic.c
+++ b/trans/magic.c
@@ -427,7 +427,7 @@ parse_opt (int opt, char *arg, struct argp_state *state)
void *buf = mmap (0, getpagesize (), PROT_READ|PROT_WRITE,
MAP_ANON, 0, 0);
if (buf == MAP_FAILED)
- return errno;
+ argp_failure (state, errno, 0, "Failed to allocate memory");
m->dirbuf = buf;
struct dirent *d;
d = add (m->dirbuf, ".");
@@ -462,6 +462,7 @@ main (int argc, char **argv)
mach_port_t bootstrap;
struct trivfs_control *fsys;
struct magic *m = calloc (1, sizeof *m);
+ assert_backtrace (m);
argp_parse (&argp, argc, argv, 0, 0, m);
diff --git a/trans/new-fifo.c b/trans/new-fifo.c
index 7880eb24..ee8f4820 100644
--- a/trans/new-fifo.c
+++ b/trans/new-fifo.c
@@ -100,6 +100,7 @@ static void
fifo_trans_create (struct fifo_trans *from, struct fifo_trans **trans)
{
struct fifo_trans *new = malloc (sizeof (struct fifo_trans));
+ assert_backtrace (new);
new->server = 0;
pthread_mutex_init (&new->active_fifo_lock, NULL);
diff --git a/trans/remap.c b/trans/remap.c
index 39d6ff92..b91fe10b 100644
--- a/trans/remap.c
+++ b/trans/remap.c
@@ -124,6 +124,9 @@ parse_opt (int key, char *arg, struct argp_state *state)
{
/* Second of a pair */
struct remap *remap = malloc (sizeof (*remap));
+ if (!remap)
+ argp_failure (state, ENOMEM, 0, "Failed to allocate memory for"
+ " remap");
remap->from = remap_from;
remap->to = strdup (arg);
remap->next = remaps;
diff --git a/utils/msgport.c b/utils/msgport.c
index e3ea4302..4b6df302 100644
--- a/utils/msgport.c
+++ b/utils/msgport.c
@@ -555,6 +555,8 @@ add_cmd (cmd_func_t func, size_t minargs, size_t maxargs,
struct cmds_argp_params *params = state->input;
size_t num_cmds = *params->num_cmds + 1;
cmd_t *cmds = realloc (*params->cmds, num_cmds * sizeof(cmd_t));
+ if (!cmds)
+ return ENOMEM;
*params->cmds = cmds;
*params->num_cmds = num_cmds;
@@ -565,6 +567,9 @@ add_cmd (cmd_func_t func, size_t minargs, size_t maxargs,
if (maxargs)
{
cmd->args = malloc (maxargs * sizeof (char *));
+ if (!cmd->args)
+ return ENOMEM;
+
if (arg)
cmd->args[i++] = arg;
while (i < maxargs
@@ -596,6 +601,9 @@ parse_cmd_opt (int key, char *arg, struct argp_state *state)
re-parse it with 2 dashes prepended. */
size_t len = strlen (arg) + 1;
arg_hack_buf = realloc (arg_hack_buf, 2 + len);
+ if (!arg_hack_buf)
+ argp_failure (state, ENOMEM, 0, "Failed to reallocate memory for"
+ " arg_hack_buf");
state->argv[--state->next] = arg_hack_buf;
state->argv[state->next][0] = '-';
state->argv[state->next][1] = '-';
diff --git a/utils/ps.c b/utils/ps.c
index 6a08f736..14dac8db 100644
--- a/utils/ps.c
+++ b/utils/ps.c
@@ -276,6 +276,8 @@ main(int argc, char *argv[])
{
size_t len = strlen (arg) + 1;
arg_hack_buf = realloc (arg_hack_buf, 1 + len);
+ if (!arg_hack_buf)
+ return ENOMEM;
state->argv[--state->next] = arg_hack_buf;
state->argv[state->next][0] = '-';
memcpy (&state->argv[state->next][1], arg, len);
diff --git a/utils/settrans.c b/utils/settrans.c
index 1622f708..1407504d 100644
--- a/utils/settrans.c
+++ b/utils/settrans.c
@@ -121,7 +121,7 @@ get_credentials (void)
return errno;
gids = malloc (gids_len * sizeof (gid_t));
- if (! uids)
+ if (! gids)
return ENOMEM;
gids_len = getgroups (gids_len, gids);
--
2.43.0
