We allocate a string for 'device', but never free it on error. And the string 'mapname' is never freed at all. Found by coverity.
Signed-off-by: Hannes Reinecke <[email protected]> --- kpartx/kpartx.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/kpartx/kpartx.c b/kpartx/kpartx.c index e8c35d4..e1ebc96 100644 --- a/kpartx/kpartx.c +++ b/kpartx/kpartx.c @@ -178,16 +178,21 @@ get_hotplug_device(void) len = strlen(mapname); /* Dirname + mapname + \0 */ - if (!(device = (char *)malloc(sizeof(char) * (off + len + 1)))) + if (!(device = (char *)malloc(sizeof(char) * (off + len + 1)))) { + free(mapname); return NULL; + } /* Create new device name. */ snprintf(device, off + 1, "%s", devname); snprintf(device + off, len + 1, "%s", mapname); - if (strlen(device) != (off + len)) + if (strlen(device) != (off + len)) { + free(device); + free(mapname); return NULL; - + } + free(mapname); return device; } -- 2.6.6 -- dm-devel mailing list [email protected] https://www.redhat.com/mailman/listinfo/dm-devel
