This is an automatic generated email to let you know that the following patch were queued at the http://git.linuxtv.org/cgit.cgi/v4l-utils.git tree:
Subject: libdvbv5: leaks and double free in dvb_fe_open_fname() Author: Sean Young <s...@mess.org> Date: Sun Mar 17 16:13:45 2019 +0000 dvb_fe_open_fname() takes ownership of fname if the function succeeds, but also in two of the error paths (e.g. if the ioctl FE_GET_PROPERTY fails). Adjust dvb_fe_open_fname() so it copies fname rather than taking ownership (and passing that to params). This makes the code cleaner. Signed-off-by: Sean Young <s...@mess.org> lib/libdvbv5/dvb-dev-local.c | 2 +- lib/libdvbv5/dvb-fe.c | 18 ++++++++---------- 2 files changed, 9 insertions(+), 11 deletions(-) --- http://git.linuxtv.org/cgit.cgi/v4l-utils.git/commit/?id=c82608ca1595427c2bdbd4abb9aca9163e1df60a diff --git a/lib/libdvbv5/dvb-dev-local.c b/lib/libdvbv5/dvb-dev-local.c index e98b967a37dd..2de9a61476f6 100644 --- a/lib/libdvbv5/dvb-dev-local.c +++ b/lib/libdvbv5/dvb-dev-local.c @@ -467,7 +467,7 @@ static struct dvb_open_descriptor flags &= ~O_NONBLOCK; } - ret = dvb_fe_open_fname(parms, strdup(dev->path), flags); + ret = dvb_fe_open_fname(parms, dev->path, flags); if (ret) { free(open_dev); return NULL; diff --git a/lib/libdvbv5/dvb-fe.c b/lib/libdvbv5/dvb-fe.c index 7dcfa53e7aba..514a187987f9 100644 --- a/lib/libdvbv5/dvb-fe.c +++ b/lib/libdvbv5/dvb-fe.c @@ -133,7 +133,6 @@ struct dvb_v5_fe_parms *dvb_fe_open_flags(int adapter, int frontend, int flags) { int ret; - char *fname; struct dvb_device *dvb; struct dvb_dev_list *dvb_dev; struct dvb_v5_fe_parms_priv *parms = NULL; @@ -153,7 +152,6 @@ struct dvb_v5_fe_parms *dvb_fe_open_flags(int adapter, int frontend, dvb_dev_free(dvb); return NULL; } - fname = strdup(dvb_dev->path); if (!strcmp(dvb_dev->bus_addr, "platform:dvbloopback")) { logfunc(LOG_WARNING, _("Detected dvbloopback")); @@ -161,14 +159,10 @@ struct dvb_v5_fe_parms *dvb_fe_open_flags(int adapter, int frontend, } dvb_dev_free(dvb); - if (!fname) { - logfunc(LOG_ERR, _("fname calloc: %s"), strerror(errno)); - return NULL; - } + parms = calloc(sizeof(*parms), 1); if (!parms) { logfunc(LOG_ERR, _("parms calloc: %s"), strerror(errno)); - free(fname); return NULL; } parms->p.verbose = verbose; @@ -183,7 +177,7 @@ struct dvb_v5_fe_parms *dvb_fe_open_flags(int adapter, int frontend, if (use_legacy_call) parms->p.legacy_fe = 1; - ret = dvb_fe_open_fname(parms, fname, flags); + ret = dvb_fe_open_fname(parms, dvb_dev->path, flags); if (ret < 0) { free(parms); return NULL; @@ -203,7 +197,6 @@ int dvb_fe_open_fname(struct dvb_v5_fe_parms_priv *parms, char *fname, fd = open(fname, flags, 0); if (fd == -1) { dvb_logerr(_("%s while opening %s"), strerror(errno), fname); - free(fname); return -errno; } @@ -226,7 +219,12 @@ int dvb_fe_open_fname(struct dvb_v5_fe_parms_priv *parms, char *fname, } } - parms->fname = fname; + parms->fname = strdup(fname); + if (!parms->fname) { + dvb_logerr(_("fname calloc: %s"), strerror(errno)); + return -errno; + } + parms->fd = fd; parms->fe_flags = flags; parms->dvb_prop[0].cmd = DTV_API_VERSION; _______________________________________________ linuxtv-commits mailing list linuxtv-commits@linuxtv.org https://www.linuxtv.org/cgi-bin/mailman/listinfo/linuxtv-commits
