Skip to content

Commit

Permalink
V4L/DVB (11515): drivers/media/video/saa5249.c: fix use-after-free an…
Browse files Browse the repository at this point in the history
…d leak

I moved the kfree() down a couple lines.  t->vdev is going to be in freed
memory so there is no point setting it to NULL.  I added a kfree(t) on a

Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
  • Loading branch information
error27 authored and Mauro Carvalho Chehab committed Apr 29, 2009
1 parent 3964b58 commit 5b83cfa
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions drivers/media/video/saa5249.c
Expand Up @@ -598,6 +598,7 @@ static int saa5249_probe(struct i2c_client *client,
/* Now create a video4linux device */
t->vdev = video_device_alloc();
if (t->vdev == NULL) {
kfree(t);
kfree(client);
return -ENOMEM;
}
Expand All @@ -617,9 +618,8 @@ static int saa5249_probe(struct i2c_client *client,
/* Register it */
err = video_register_device(t->vdev, VFL_TYPE_VTX, -1);
if (err < 0) {
kfree(t);
video_device_release(t->vdev);
t->vdev = NULL;
kfree(t);
return err;
}
return 0;
Expand Down

0 comments on commit 5b83cfa

Please sign in to comment.