Attachment 53852 Details for Bug 43247 – fix

[patch] fix

0001-delete_io_handle-fix-deletion-of-last-handle.patch (text/plain), 1.40 KB, created by Daniel Drake on 2011-11-25 10:37:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Daniel Drake

Created: 2011-11-25 10:37:36 UTC

Size: 1.40 KB

patch

obsolete

>From fc1e448e89a737cbb27462c06375978d27aa5271 Mon Sep 17 00:00:00 2001
>From: Daniel Drake <dsd@laptop.org>
>Date: Fri, 25 Nov 2011 12:28:48 -0600
>Subject: [PATCH] delete_io_handle: fix deletion of last handle
>
>When num_ios goes from 1 to 0, a realloc(ios, 0); call is made.
>This is equivalent to free(ios) and NULL is returned.
>
>However, the previous logic in the code incorrectly discards this NULL
>return value. When we next call new_io_handle(), realloc(ios, X) is
>called with "ios" pointing to freed memory. This causes glibc to abort.
>
>Correct this logic to detect the 1-to-0 case and handle it correctly.
>Other cases are unchanged; there is still value in checking the
>return value from realloc() as it also returns NULL on error.
>
>Signed-off-by: Daniel Drake <dsd@laptop.org>
>---
> src/common_io.c |   11 ++++++++---
> 1 files changed, 8 insertions(+), 3 deletions(-)
>
>diff --git a/src/common_io.c b/src/common_io.c
>index f1319f8..5b35e07 100644
>--- a/src/common_io.c
>+++ b/src/common_io.c
>@@ -64,10 +64,15 @@ delete_io_handle(struct pci_io_handle *handle)
>         }
>     }
> 
>-    new = realloc(ios, sizeof(struct pci_io_handle) * (num_ios - 1));
>-    if (new)
>-        ios = new;
>     num_ios--;
>+    if (num_ios) {
>+        new = realloc(ios, sizeof(struct pci_io_handle) * num_ios);
>+        if (new)
>+            ios = new;
>+    } else {
>+        free(ios);
>+        ios = NULL;
>+    }
> }
> 
> _pci_hidden void
>-- 
>1.7.7.3
>

Actions: View | Splinter Review

Attachments on bug 43247: 53852

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.