Skip to content

Commit

Permalink
aspeed: Fix a potential memory leak bug in write_boot_rom()
Browse files Browse the repository at this point in the history
A memory chunk is allocated with g_new0() and assigned to the variable
'storage'. However, if the branch takes true, there will be only an
error report but not a free operation for 'storage' before function
returns. As a result, a memory leak bug is triggered.

Use g_autofree to fix the issue.

Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Wentao_Liang <Wentao_Liang_g@163.com>
[ clg: reworked the commit log ]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
  • Loading branch information
Wentao-Liang authored and legoater committed Mar 8, 2022
1 parent b49872a commit 05e6e40
Showing 1 changed file with 2 additions and 3 deletions.
5 changes: 2 additions & 3 deletions hw/arm/aspeed.c
Expand Up @@ -246,7 +246,7 @@ static void write_boot_rom(DriveInfo *dinfo, hwaddr addr, size_t rom_size,
Error **errp)
{
BlockBackend *blk = blk_by_legacy_dinfo(dinfo);
uint8_t *storage;
g_autofree void *storage = NULL;
int64_t size;

/* The block backend size should have already been 'validated' by
Expand All @@ -262,14 +262,13 @@ static void write_boot_rom(DriveInfo *dinfo, hwaddr addr, size_t rom_size,
rom_size = size;
}

storage = g_new0(uint8_t, rom_size);
storage = g_malloc0(rom_size);
if (blk_pread(blk, 0, storage, rom_size) < 0) {
error_setg(errp, "failed to read the initial flash content");
return;
}

rom_add_blob_fixed("aspeed.boot_rom", storage, rom_size, addr);
g_free(storage);
}

static void aspeed_board_init_flashes(AspeedSMCState *s,
Expand Down

0 comments on commit 05e6e40

Please sign in to comment.