In build_volume(), check if arrays is allocated before traversing its

items.  While parsing the arrays input, it's possible that we reach the
error path before initializing the 'arrays' pointer, which in turn leads
to a NULL deference.

Submitted by:	Garrett Cooper
MFC after:	1 week

1 files changed, 5 insertions, 3 deletions

diff --git a/usr.sbin/mfiutil/mfi_config.c b/usr.sbin/mfiutil/mfi_config.c
index ba6ce2d..32cb171 100644
--- a/usr.sbin/mfiutil/mfi_config.c
+++ b/usr.sbin/mfiutil/mfi_config.c
@@ -820,9 +820,11 @@ error:
 	free(config);
 	free(state.volumes);
 	free(state.arrays);
-	for (i = 0; i < narrays; i++)
-		free(arrays[i].drives);
-	free(arrays);
+	if (arrays != NULL) {
+		for (i = 0; i < narrays; i++)
+			free(arrays[i].drives);
+		free(arrays);
+	}
 	close(fd);
 
 	return (error);