diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2014-02-17 18:55:31 +0000 |
|---|---|---|
| committer | Riku Voipio <riku.voipio@linaro.org> | 2014-02-18 16:54:06 +0200 |
| commit | 6afafa86f3446f5e6dd410cc2c442e98adabc26c (patch) | |
| tree | 1a92ccfbf311fa0ad777862b232022faad06a557 | |
| parent | 4fc4732047bf475f70b14c83053d7c6b22cb9d2f (diff) | |
linux-user/elfload.c: Avoid calling g_free() on uninitialized data
Avoid calling g_free() on unintialized data in the error-handling
paths in elf_core_dump() by splitting the initialization of the
elf_note_info struct out of fill_note_info() so that it's always
valid to call free_note_info() whether we got to the point of
being able to fill_note_info() or not.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Riku Voipio <riku.voipio@linaro.org>
| -rw-r--r-- | linux-user/elfload.c | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/linux-user/elfload.c b/linux-user/elfload.c index 5902f162b4..c0687e3b38 100644 --- a/linux-user/elfload.c +++ b/linux-user/elfload.c @@ -2636,6 +2636,16 @@ static void fill_thread_info(struct elf_note_info *info, const CPUArchState *env info->notes_size += note_size(&ets->notes[0]); } +static void init_note_info(struct elf_note_info *info) +{ + /* Initialize the elf_note_info structure so that it is at + * least safe to call free_note_info() on it. Must be + * called before calling fill_note_info(). + */ + memset(info, 0, sizeof (*info)); + QTAILQ_INIT(&info->thread_list); +} + static int fill_note_info(struct elf_note_info *info, long signr, const CPUArchState *env) { @@ -2644,10 +2654,6 @@ static int fill_note_info(struct elf_note_info *info, TaskState *ts = (TaskState *)env->opaque; int i; - (void) memset(info, 0, sizeof (*info)); - - QTAILQ_INIT(&info->thread_list); - info->notes = g_malloc0(NUMNOTES * sizeof (struct memelfnote)); if (info->notes == NULL) return (-ENOMEM); @@ -2781,6 +2787,8 @@ static int elf_core_dump(int signr, const CPUArchState *env) int segs = 0; int fd = -1; + init_note_info(&info); + errno = 0; getrlimit(RLIMIT_CORE, &dumpsize); if (dumpsize.rlim_cur == 0) |