diff options
author | delphij <delphij@FreeBSD.org> | 2009-03-28 07:20:39 +0000 |
---|---|---|
committer | delphij <delphij@FreeBSD.org> | 2009-03-28 07:20:39 +0000 |
commit | b4ced14429dedd5fd4aee43789bd5982fb9c025c (patch) | |
tree | 6a141bebea11ff825e60503477cbb6f1421ca80f /lib/libc/db | |
parent | 67cfc8aca68a9ff46aee6d7f86315f2c57f4db64 (diff) | |
download | FreeBSD-src-b4ced14429dedd5fd4aee43789bd5982fb9c025c.zip FreeBSD-src-b4ced14429dedd5fd4aee43789bd5982fb9c025c.tar.gz |
Plug memory leaks and a potential NULL dereference.
Obtained from: OpenBSD
Diffstat (limited to 'lib/libc/db')
-rw-r--r-- | lib/libc/db/hash/hash.c | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/lib/libc/db/hash/hash.c b/lib/libc/db/hash/hash.c index dda70f8..b58b36f 100644 --- a/lib/libc/db/hash/hash.c +++ b/lib/libc/db/hash/hash.c @@ -163,7 +163,6 @@ __hash_open(const char *file, int flags, int mode, */ nsegs = (hashp->MAX_BUCKET + 1 + hashp->SGSIZE - 1) / hashp->SGSIZE; - hashp->nsegs = 0; if (alloc_segs(hashp, nsegs)) /* * If alloc_segs fails, table will have been destroyed @@ -417,6 +416,10 @@ hdestroy(HTAB *hashp) for (i = 0; i < hashp->nmaps; i++) if (hashp->mapp[i]) free(hashp->mapp[i]); + if (hashp->tmp_key) + free(hashp->tmp_key); + if (hashp->tmp_buf) + free(hashp->tmp_buf); if (hashp->fp != -1) (void)_close(hashp->fp); @@ -762,6 +765,8 @@ hash_seq(const DB *dbp, DBT *key, DBT *data, u_int32_t flag) if (__big_keydata(hashp, bufp, key, data, 1)) return (ERROR); } else { + if (hashp->cpage == 0) + return (ERROR); key->data = (u_char *)hashp->cpage->page + bp[ndx]; key->size = (ndx > 1 ? bp[ndx - 1] : hashp->BSIZE) - bp[ndx]; data->data = (u_char *)hashp->cpage->page + bp[ndx + 1]; @@ -877,15 +882,18 @@ alloc_segs(HTAB *hashp, int nsegs) errno = save_errno; return (-1); } + hashp->nsegs = nsegs; + if (nsegs == 0) + return (0); /* Allocate segments */ - if ((store = - (SEGMENT)calloc(nsegs << hashp->SSHIFT, sizeof(SEGMENT))) == NULL) { + if ((store = (SEGMENT)calloc(nsegs << hashp->SSHIFT, + sizeof(SEGMENT))) == NULL) { save_errno = errno; (void)hdestroy(hashp); errno = save_errno; return (-1); } - for (i = 0; i < nsegs; i++, hashp->nsegs++) + for (i = 0; i < nsegs; i++) hashp->dir[i] = &store[i << hashp->SSHIFT]; return (0); } |