aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSean Young <sean@mess.org>2019-03-17 16:13:45 (GMT)
committerSean Young <sean@mess.org>2019-03-17 16:31:07 (GMT)
commitebd890019ba7383b8b486d829f6683c8f49fdbda (patch)
tree3db49cff67a001f0746da416ac1a405c76a972ae
parent39da4509b08eef558a5b416ac688cc3e35e30346 (diff)
libdvbv5: leaks and double free in dvb_fe_open_fname()HEADmaster
dvb_fe_open_fname() takes ownership of fname if the function succeeds, but also in two of the error paths (e.g. if the ioctl FE_GET_PROPERTY fails). Adjust dvb_fe_open_fname() so it copies fname rather than taking ownership (and passing that to params). This makes the code cleaner. Signed-off-by: Sean Young <sean@mess.org>
-rw-r--r--lib/libdvbv5/dvb-dev-local.c2
-rw-r--r--lib/libdvbv5/dvb-fe.c18
2 files changed, 9 insertions, 11 deletions
diff --git a/lib/libdvbv5/dvb-dev-local.c b/lib/libdvbv5/dvb-dev-local.c
index e98b967..2de9a61 100644
--- a/lib/libdvbv5/dvb-dev-local.c
+++ b/lib/libdvbv5/dvb-dev-local.c
@@ -467,7 +467,7 @@ static struct dvb_open_descriptor
flags &= ~O_NONBLOCK;
}
- ret = dvb_fe_open_fname(parms, strdup(dev->path), flags);
+ ret = dvb_fe_open_fname(parms, dev->path, flags);
if (ret) {
free(open_dev);
return NULL;
diff --git a/lib/libdvbv5/dvb-fe.c b/lib/libdvbv5/dvb-fe.c
index 5dcf492..7f63476 100644
--- a/lib/libdvbv5/dvb-fe.c
+++ b/lib/libdvbv5/dvb-fe.c
@@ -133,7 +133,6 @@ struct dvb_v5_fe_parms *dvb_fe_open_flags(int adapter, int frontend,
int flags)
{
int ret;
- char *fname;
struct dvb_device *dvb;
struct dvb_dev_list *dvb_dev;
struct dvb_v5_fe_parms_priv *parms = NULL;
@@ -153,7 +152,6 @@ struct dvb_v5_fe_parms *dvb_fe_open_flags(int adapter, int frontend,
dvb_dev_free(dvb);
return NULL;
}
- fname = strdup(dvb_dev->path);
if (!strcmp(dvb_dev->bus_addr, "platform:dvbloopback")) {
logfunc(LOG_WARNING, _("Detected dvbloopback"));
@@ -161,14 +159,10 @@ struct dvb_v5_fe_parms *dvb_fe_open_flags(int adapter, int frontend,
}
dvb_dev_free(dvb);
- if (!fname) {
- logfunc(LOG_ERR, _("fname calloc: %s"), strerror(errno));
- return NULL;
- }
+
parms = calloc(sizeof(*parms), 1);
if (!parms) {
logfunc(LOG_ERR, _("parms calloc: %s"), strerror(errno));
- free(fname);
return NULL;
}
parms->p.verbose = verbose;
@@ -183,7 +177,7 @@ struct dvb_v5_fe_parms *dvb_fe_open_flags(int adapter, int frontend,
if (use_legacy_call)
parms->p.legacy_fe = 1;
- ret = dvb_fe_open_fname(parms, fname, flags);
+ ret = dvb_fe_open_fname(parms, dvb_dev->path, flags);
if (ret < 0) {
dvb_v5_free(parms);
return NULL;
@@ -203,7 +197,6 @@ int dvb_fe_open_fname(struct dvb_v5_fe_parms_priv *parms, char *fname,
fd = open(fname, flags, 0);
if (fd == -1) {
dvb_logerr(_("%s while opening %s"), strerror(errno), fname);
- free(fname);
return -errno;
}
@@ -224,7 +217,12 @@ int dvb_fe_open_fname(struct dvb_v5_fe_parms_priv *parms, char *fname,
}
}
- parms->fname = fname;
+ parms->fname = strdup(fname);
+ if (!parms->fname) {
+ dvb_logerr(_("fname calloc: %s"), strerror(errno));
+ return -errno;
+ }
+
parms->fd = fd;
parms->fe_flags = flags;
parms->dvb_prop[0].cmd = DTV_API_VERSION;

Privacy Policy