Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 22 Jun 2006 12:35:04 -0300
From:      Pedro Martelletto <pedro@ambientworks.net>
To:        freebsd-fs@freebsd.org
Subject:   plug memory leaks and fix nested loops in udf_find_partmaps()
Message-ID:  <20060622153504.GB835@static.protection.cx>

next in thread | raw e-mail | index | archive | help
currently, there are two nested 'for' loops in udf_find_partmaps() which
use the same control variable (i), as well as memory leaks in two error
paths, which the following diff should fix.

-p.

Index: udf_vfsops.c
===================================================================
RCS file: /home/ncvs/src/sys/fs/udf/udf_vfsops.c,v
retrieving revision 1.41
diff -u -p -r1.41 udf_vfsops.c
--- udf_vfsops.c	26 May 2006 01:21:51 -0000	1.41
+++ udf_vfsops.c	22 Jun 2006 15:08:25 -0000
@@ -728,7 +728,7 @@ udf_find_partmaps(struct udf_mnt *udfmp,
 	struct regid *pmap_id;
 	struct buf *bp;
 	unsigned char regid_id[UDF_REGID_ID_SIZE + 1];
-	int i, ptype, psize, error;
+	int i, k, ptype, psize, error;
 
 	for (i = 0; i < le32toh(lvd->n_pm); i++) {
 		pmap = (union udf_pmap *)&lvd->maps[i * UDF_PMAP_SIZE];
@@ -776,6 +776,7 @@ udf_find_partmaps(struct udf_mnt *udfmp,
 				brelse(bp);
 			printf("Failed to read Sparing Table at sector %d\n",
 			    le32toh(pms->st_loc[0]));
+			FREE(udfmp->s_table, M_UDFMOUNT);
 			return (error);
 		}
 		bcopy(bp->b_data, udfmp->s_table, le32toh(pms->st_size));
@@ -783,15 +784,16 @@ udf_find_partmaps(struct udf_mnt *udfmp,
 
 		if (udf_checktag(&udfmp->s_table->tag, 0)) {
 			printf("Invalid sparing table found\n");
+			FREE(udfmp->s_table, M_UDFMOUNT);
 			return (EINVAL);
 		}
 
 		/* See how many valid entries there are here.  The list is
 		 * supposed to be sorted. 0xfffffff0 and higher are not valid
 		 */
-		for (i = 0; i < le16toh(udfmp->s_table->rt_l); i++) {
-			udfmp->s_table_entries = i;
-			if (le32toh(udfmp->s_table->entries[i].org) >=
+		for (k = 0; k < le16toh(udfmp->s_table->rt_l); k++) {
+			udfmp->s_table_entries = k;
+			if (le32toh(udfmp->s_table->entries[k].org) >=
 			    0xfffffff0)
 				break;
 		}



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060622153504.GB835>