From 9d9bfe594814dbd5ff133779d3cf8dcb1c237186 Mon Sep 17 00:00:00 2001 From: Jia-Ju Bai Date: Wed, 24 Jul 2019 10:46:58 +0800 Subject: jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree() In jffs2_add_frag_to_fragtree(), there is an if statement on line 223 to check whether "this" is NULL: if (this) When "this" is NULL, it is used at several places, such as on line 249: if (this->node) and on line 260: if (newfrag->ofs > this->ofs) Thus possible null-pointer dereferences may occur. To fix these bugs, -EINVAL is returned when "this" is NULL. These bugs are found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai Signed-off-by: Richard Weinberger --- cpukit/libfs/src/jffs2/src/nodelist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'cpukit/libfs/src') diff --git a/cpukit/libfs/src/jffs2/src/nodelist.c b/cpukit/libfs/src/jffs2/src/nodelist.c index ee44024c92..86dd8e60d1 100644 --- a/cpukit/libfs/src/jffs2/src/nodelist.c +++ b/cpukit/libfs/src/jffs2/src/nodelist.c @@ -228,7 +228,7 @@ static int jffs2_add_frag_to_fragtree(struct jffs2_sb_info *c, struct rb_root *r lastend = this->ofs + this->size; } else { dbg_fragtree2("lookup gave no frag\n"); - lastend = 0; + return -EINVAL; } /* See if we ran off the end of the fragtree */ -- cgit v1.2.3