marko10_000
/
btrfs-progs
forked from Mirrors/btrfs-progs
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

btrfs-progs: fix use after free in replace start 

Commit "btrfs-progs: Add further checks to btrfs replace start command"
accesses device size just after its memory is freed.

Resolves-coverity-id: 1320425
Signed-off-by: David Sterba <dsterba@suse.com>
master
David Sterba 2015-08-26 13:34:39 +02:00
parent f32b82ba98
commit bf3639dc62
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cmds-replace.c
View File

@ -245,13 +245,13 @@ static int cmd_replace_start(int argc, char **argv)
for (i = 0; i < fi_args.num_devices; i++)
if (start_args.start.srcdevid == di_args[i].devid)
break;
srcdev_size = di_args[i].total_bytes;
free(di_args);
if (i == fi_args.num_devices) {
fprintf(stderr, "Error: '%s' is not a valid devid for filesystem '%s'\n",
srcdev, path);
goto leave_with_error;
}
srcdev_size = di_args[i].total_bytes;
} else if (is_block_device(srcdev) > 0) {
strncpy((char *)start_args.start.srcdev_name, srcdev,
BTRFS_DEVICE_PATH_NAME_MAX);