[lvm-devel] [PATCH] libdm: Fix memory corruption if dm_asprintf fails.
Mikulas Patocka
mpatocka at redhat.com
Fri Oct 18 00:31:55 UTC 2013
I found this bug when reading through my lvm changes.
We must set the variable dmt->geometry to NULL after freeing it.
dm_asprintf may fail, on failure it may not set dmt->geometry, thus
dmt->geometry would be pointing to a free string.
Signed-off-by: Mikulas Patocka <mpatocka at redhat.com>
---
libdm/ioctl/libdm-iface.c | 1 +
1 file changed, 1 insertion(+)
Index: lvm2-copy/libdm/ioctl/libdm-iface.c
===================================================================
--- lvm2-copy.orig/libdm/ioctl/libdm-iface.c 2013-10-18 02:26:07.000000000 +0200
+++ lvm2-copy/libdm/ioctl/libdm-iface.c 2013-10-18 02:26:16.000000000 +0200
@@ -817,6 +817,7 @@ int dm_task_set_geometry(struct dm_task
const char *sectors, const char *start)
{
dm_free(dmt->geometry);
+ dmt->geometry = NULL;
if (dm_asprintf(&(dmt->geometry), "%s %s %s %s",
cylinders, heads, sectors, start) < 0) {
log_error("dm_task_set_geometry: sprintf failed");
More information about the lvm-devel
mailing list