We allocate a string for 'device', but never free it on error.
And the string 'mapname' is never freed at all.
Found by coverity.
Signed-off-by: Hannes Reinecke <hare@xxxxxxxx>
---
kpartx/kpartx.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/kpartx/kpartx.c b/kpartx/kpartx.c
index e8c35d4..e1ebc96 100644
--- a/kpartx/kpartx.c
+++ b/kpartx/kpartx.c
@@ -178,16 +178,21 @@ get_hotplug_device(void)
len = strlen(mapname);
/* Dirname + mapname + \0 */
- if (!(device = (char *)malloc(sizeof(char) * (off + len + 1))))
+ if (!(device = (char *)malloc(sizeof(char) * (off + len + 1)))) {
+ free(mapname);
return NULL;
+ }
/* Create new device name. */
snprintf(device, off + 1, "%s", devname);
snprintf(device + off, len + 1, "%s", mapname);
- if (strlen(device) != (off + len))
+ if (strlen(device) != (off + len)) {
+ free(device);
+ free(mapname);
return NULL;
-
+ }
+ free(mapname);
return device;
}
--
2.6.6
--
dm-devel mailing list
dm-devel@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/dm-devel
