[PATCH] info: Handle failure of call to file
by Thomas Weißschuh
The buffer allocated by getline() for the lineptr argument needs to be
freed even if getline() fails.
The corollary of this is that even in a failure case the pointer is
non-null but points to garbage data.
Properly handle the failure by freeing the pointer and returning NULL to
indicate that failure to the caller.
Signed-off-by: Thomas Weißschuh <thomas(a)t-8ch.de>
---
info/show.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/info/show.c b/info/show.c
index a3a57ef00ce6..1596eb77e62a 100644
--- a/info/show.c
+++ b/info/show.c
@@ -398,8 +398,11 @@ get_content (struct nbd_handle *nbd, int64_t size)
if (fp == NULL)
goto out;
r = getline (&ret, &len, fp);
- if (r == -1)
+ if (r == -1) {
+ free(ret);
+ ret = NULL;
goto out;
+ }
/* Remove trailing \n. */
if (r > 0 && ret[r-1] == '\n')
base-commit: 673a8c38571e128e6581c7e6ed6c45461c30bc8f
prerequisite-patch-id: 637ca3e7b5e88873d34b2865a134427338700b72
--
2.44.0
9 months, 3 weeks
[PATCH libnbd INCOMPLETE v2 0/3] fuzzing: Add and use fuzzed data provider
by Richard W.M. Jones
As before this patch still doesn't work at a conceptual level, however
I'm posting it so we have a record of the code.
The current problem is that it can deadlock during
nbd_connect_socket() if there isn't enough data in the <initial server
buffer> to complete NBD negotiation, which would actually happen quite
commonly in the real world.
There's not really any way I can see around this except to somehow
have two separate streams of data, one for the NBD protocol from the
"server", and one for the list of commands. That's not really how
fuzzers work though.
Rich.
9 months, 3 weeks