diff mbox

[6/6] linux-user: Fix error handling in target_to_host_semarray()

Message ID 69d4c703a549f0630793a67b16a8fc6bc14c8654.1392805802.git.riku.voipio@linaro.org
State Accepted
Commit 69d4c703a549f0630793a67b16a8fc6bc14c8654
Headers show

Commit Message

Riku Voipio Feb. 19, 2014, 10:35 a.m. UTC 
From: Peter Maydell <peter.maydell@linaro.org>

Fix two issues in error handling in target_to_host_semarray():
 * don't leak the host_array buffer if lock_user fails
 * return an error if malloc() fails

v2: added missing * -Riku Voipio

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Riku Voipio <riku.voipio@linaro.org>
---
 linux-user/syscall.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)
diff mbox

Patch

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 8f5a58e..1407b7a 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -2430,10 +2430,15 @@  static inline abi_long target_to_host_semarray(int semid, unsigned short **host_
     nsems = semid_ds.sem_nsems;
 
     *host_array = malloc(nsems*sizeof(unsigned short));
+    if (!*host_array) {
+        return -TARGET_ENOMEM;
+    }
     array = lock_user(VERIFY_READ, target_addr,
                       nsems*sizeof(unsigned short), 1);
-    if (!array)
+    if (!array) {
+        free(*host_array);
         return -TARGET_EFAULT;
+    }
 
     for(i=0; i<nsems; i++) {
         __get_user((*host_array)[i], &array[i]);