Date: Thu, 22 Mar 2018 22:13:46 +0000 (UTC) From: "Landon J. Fuller" <landonf@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r331378 - head/sys/dev/bhnd/nvram Message-ID: <201803222213.w2MMDk07048458@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: landonf Date: Thu Mar 22 22:13:46 2018 New Revision: 331378 URL: https://svnweb.freebsd.org/changeset/base/331378 Log: Add missing NULL checks when calling malloc(M_NOWAIT) in bhnd_nv_strdup/bhnd_nv_strndup. If malloc(9) failed during initial bhnd(4) attach, while allocating the root NVRAM path string ("/"), the returned NULL pointer would be passed as the destination to memcpy(). Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com> Modified: head/sys/dev/bhnd/nvram/bhnd_nvram_private.h Modified: head/sys/dev/bhnd/nvram/bhnd_nvram_private.h ============================================================================== --- head/sys/dev/bhnd/nvram/bhnd_nvram_private.h Thu Mar 22 21:57:10 2018 (r331377) +++ head/sys/dev/bhnd/nvram/bhnd_nvram_private.h Thu Mar 22 22:13:46 2018 (r331378) @@ -91,6 +91,9 @@ bhnd_nv_strdup(const char *str) len = strlen(str); dest = malloc(len + 1, M_BHND_NVRAM, M_NOWAIT); + if (dest == NULL) + return (NULL); + memcpy(dest, str, len); dest[len] = '\0'; @@ -105,6 +108,9 @@ bhnd_nv_strndup(const char *str, size_t len) len = strnlen(str, len); dest = malloc(len + 1, M_BHND_NVRAM, M_NOWAIT); + if (dest == NULL) + return (NULL); + memcpy(dest, str, len); dest[len] = '\0';
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201803222213.w2MMDk07048458>