Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 8 Aug 2023 18:13:19 GMT
From:      Ed Maste <emaste@FreeBSD.org>
To:        src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org
Subject:   git: 2030f99a9aac - stable/12 - cd9660: do not leak buffers in cd9660_rrip_loop()
Message-ID:  <202308081813.378IDJCo006894@gitrepo.freebsd.org>

next in thread | raw e-mail | index | archive | help
The branch stable/12 has been updated by emaste:

URL: https://cgit.FreeBSD.org/src/commit/?id=2030f99a9aac92b06e16f0f21a3307df8ee90acd

commit 2030f99a9aac92b06e16f0f21a3307df8ee90acd
Author:     Konstantin Belousov <kib@FreeBSD.org>
AuthorDate: 2023-07-31 22:55:13 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2023-08-08 18:12:29 +0000

    cd9660: do not leak buffers in cd9660_rrip_loop()
    
    PR:     272856
    
    (cherry picked from commit fa3cf6cdc68cb6d6f2c440f2653258d68eae1015)
    (cherry picked from commit 746c8f0cd7061bcda4bb68cb612827288459bee6)
---
 sys/fs/cd9660/cd9660_rrip.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/sys/fs/cd9660/cd9660_rrip.c b/sys/fs/cd9660/cd9660_rrip.c
index 55833ea73dd5..1cae8463e8f6 100644
--- a/sys/fs/cd9660/cd9660_rrip.c
+++ b/sys/fs/cd9660/cd9660_rrip.c
@@ -553,12 +553,18 @@ cd9660_rrip_loop(isodir,ana,table)
 		}
 
 		if (ana->fields && ana->iso_ce_len) {
-			if (ana->iso_ce_blk >= ana->imp->volume_space_size
-			    || ana->iso_ce_off + ana->iso_ce_len > ana->imp->logical_block_size
-			    || bread(ana->imp->im_devvp,
-				     ana->iso_ce_blk <<
-				     (ana->imp->im_bshift - DEV_BSHIFT),
-				     ana->imp->logical_block_size, NOCRED, &bp))
+			if (ana->iso_ce_blk >= ana->imp->volume_space_size ||
+			    ana->iso_ce_off + ana->iso_ce_len >
+			    ana->imp->logical_block_size)
+				break;
+			if (bp != NULL) {
+				brelse(bp);
+				bp = NULL;
+			}
+			if (bread(ana->imp->im_devvp,
+			    ana->iso_ce_blk <<
+			    (ana->imp->im_bshift - DEV_BSHIFT),
+			    ana->imp->logical_block_size, NOCRED, &bp) != 0)
 				/* what to do now? */
 				break;
 			phead = (ISO_SUSP_HEADER *)(bp->b_data + ana->iso_ce_off);



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202308081813.378IDJCo006894>