[Xen-devel] [PATCH 25/32] block-vvfat: fix memory/handle leaks in commit_one_file()

[Andrew Cooper]

From: Kaifeng Zhu <kaifeng....@citrix.com>

Some handles and memory in commit_one_file are going to be leaked if
certain function calls failed.

Signed-off-by: Kaifeng Zhu <kaifeng....@citrix.com>
Coverity-IDs: 1055918 1055919
Reviewed-by: Andrew Cooper <andrew.coop...@citrix.com>
---
 block-vvfat.c |   17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/block-vvfat.c b/block-vvfat.c
index 345d7be..ec3363c 100644
--- a/block-vvfat.c
+++ b/block-vvfat.c
@@ -2229,11 +2229,15 @@ static int commit_one_file(BDRVVVFATState* s,
     if (fd < 0) {
        fprintf(stderr, "Could not open %s... (%s, %d)\n", mapping->path,
                strerror(errno), errno);
+       qemu_free(cluster);
        return fd;
     }
     if (offset > 0)
-       if (lseek(fd, offset, SEEK_SET) != offset)
+       if (lseek(fd, offset, SEEK_SET) != offset) {
+           close(fd);
+           qemu_free(cluster);
            return -3;
+       }
 
     while (offset < size) {
        uint32_t c1;
@@ -2249,11 +2253,17 @@ static int commit_one_file(BDRVVVFATState* s,
        ret = vvfat_read(s->bs, cluster2sector(s, c),
            (uint8_t*)cluster, (rest_size + 0x1ff) / 0x200);
 
-       if (ret < 0)
+       if (ret < 0) {
+           close(fd);
+           qemu_free(cluster);
            return ret;
+       }
 
-       if (qemu_write_ok(fd, cluster, rest_size) < 0)
+       if (qemu_write_ok(fd, cluster, rest_size) < 0) {
+           close(fd);
+           qemu_free(cluster);
            return -2;
+       }
 
        offset += rest_size;
        c = c1;
@@ -2261,6 +2271,7 @@ static int commit_one_file(BDRVVVFATState* s,
 
     ftruncate(fd, size);
     close(fd);
+    qemu_free(cluster);
 
     return commit_mappings(s, first_cluster, dir_index);
 }
-- 
1.7.10.4


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel