search for: guestfs_int_dir

If "strdup (d->d_name)" fails with "i" > 0, then both "p" and "ret->guestfs_int_dirent_list_val" are non-null pointers, but the latter is no more valid (since "p" is the new realloc'ed buffer). Hence, trying to free both will access to invalid memory. Make sure to free only one of them, "p" if not null or "ret->guestfs_int_dirent_list_val&quot...

On Tue, Jan 20, 2015 at 04:28:39PM +0100, Pino Toscano wrote: > If "strdup (d->d_name)" fails with "i" > 0, then both "p" and > "ret->guestfs_int_dirent_list_val" are non-null pointers, but the latter > is no more valid (since "p" is the new realloc'ed buffer). Hence, trying > to free both will access to invalid memory. > > Make sure to free only one of them, "p" if not null or > "ret->guestfs...

These two patches are probably not completely independent, but separating them is a lot of work. With *both* patches applied, all the tests and extra-tests pass. That's no guarantee however that there isn't a mistake, so I don't think this patch is a candidate for the 1.16 branch, until it's had a lot more testing in development. Rich.

...brary, expected 0x%x\n", - flag, GUESTFS_CANCEL_FLAG); + flag, GUESTFS_CANCEL_FLAG); return 0; } diff --git a/daemon/readdir.c b/daemon/readdir.c index e3851db..17fc619 100644 --- a/daemon/readdir.c +++ b/daemon/readdir.c @@ -63,7 +63,7 @@ do_readdir (char *path) guestfs_int_dirent *p; p = realloc (ret->guestfs_int_dirent_list_val, - sizeof (guestfs_int_dirent) * (i+1)); + sizeof (guestfs_int_dirent) * (i+1)); v.name = strdup (d->d_name); if (!p || !v.name) { reply_with_perror ("allocate"); diff --git a/daemon/sfdisk...

This started as a simple warning-elimination change. I'll get back to that series shortly ;-) It turned into a factorization and constification exercise during which I got a taste of ocaml. Thanks to Rich Jones for help with a few snippets in generator.ml. The overall result is that many previously-manually-maintained bits from daemon/*.c functions are now hoisted into the automatically-