From c580dee4e170adad1ebdf901d32f0e1ed7d125b9 Mon Sep 17 00:00:00 2001 From: Stefan Weil Date: Mon, 21 Nov 2011 21:06:22 +0100 Subject: bsd_user: Fix potential null pointer dereference This bug was spotted by cppcheck. Using g_try_malloc0 (as does the linux-user code) fixes this. v2: Use g_free in bsdload.c, too. Thanks to Peter Maydell for this hint. Signed-off-by: Stefan Weil Signed-off-by: Blue Swirl --- bsd-user/elfload.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'bsd-user/elfload.c') diff --git a/bsd-user/elfload.c b/bsd-user/elfload.c index 1ef1f97..1288884 100644 --- a/bsd-user/elfload.c +++ b/bsd-user/elfload.c @@ -641,8 +641,7 @@ static abi_ulong copy_elf_strings(int argc,char ** argv, void **page, offset = p % TARGET_PAGE_SIZE; pag = (char *)page[p/TARGET_PAGE_SIZE]; if (!pag) { - pag = (char *)malloc(TARGET_PAGE_SIZE); - memset(pag, 0, TARGET_PAGE_SIZE); + pag = g_try_malloc0(TARGET_PAGE_SIZE); page[p/TARGET_PAGE_SIZE] = pag; if (!pag) return 0; @@ -696,7 +695,7 @@ static abi_ulong setup_arg_pages(abi_ulong p, struct linux_binprm *bprm, info->rss++; /* FIXME - check return value of memcpy_to_target() for failure */ memcpy_to_target(stack_base, bprm->page[i], TARGET_PAGE_SIZE); - free(bprm->page[i]); + g_free(bprm->page[i]); } stack_base += TARGET_PAGE_SIZE; } -- cgit v1.1