diff options
| author | Jia-Ju Bai <baijiaju1990@gmail.com> | 2019-07-24 10:46:58 +0800 |
|---|---|---|
| committer | Sebastian Huber <sebastian.huber@embedded-brains.de> | 2022-06-20 13:25:32 +0200 |
| commit | 9d9bfe594814dbd5ff133779d3cf8dcb1c237186 (patch) | |
| tree | 48897860c84bbf28345c428df63303b8bd89d555 /cpukit/libfs/src | |
| parent | jffs2: Remove C++ style comments from uapi header (diff) | |
| download | rtems-9d9bfe594814dbd5ff133779d3cf8dcb1c237186.tar.bz2 | |
jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()
In jffs2_add_frag_to_fragtree(), there is an if statement on line 223 to
check whether "this" is NULL:
if (this)
When "this" is NULL, it is used at several places, such as on line 249:
if (this->node)
and on line 260:
if (newfrag->ofs > this->ofs)
Thus possible null-pointer dereferences may occur.
To fix these bugs, -EINVAL is returned when "this" is NULL.
These bugs are found by a static analysis tool STCheck written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Diffstat (limited to 'cpukit/libfs/src')
| -rw-r--r-- | cpukit/libfs/src/jffs2/src/nodelist.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/cpukit/libfs/src/jffs2/src/nodelist.c b/cpukit/libfs/src/jffs2/src/nodelist.c index ee44024c92..86dd8e60d1 100644 --- a/cpukit/libfs/src/jffs2/src/nodelist.c +++ b/cpukit/libfs/src/jffs2/src/nodelist.c @@ -228,7 +228,7 @@ static int jffs2_add_frag_to_fragtree(struct jffs2_sb_info *c, struct rb_root *r lastend = this->ofs + this->size; } else { dbg_fragtree2("lookup gave no frag\n"); - lastend = 0; + return -EINVAL; } /* See if we ran off the end of the fragtree */ |