Commit f2538f99 authored Jul 24, 2019 by Jia-Ju Bai Committed by Richard Weinberger Sep 15, 2019

jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()



In jffs2_add_frag_to_fragtree(), there is an if statement on line 223 to
check whether "this" is NULL:
    if (this)

When "this" is NULL, it is used at several places, such as on line 249:
    if (this->node)
and on line 260:
    if (newfrag->ofs > this->ofs)

Thus possible null-pointer dereferences may occur.

To fix these bugs, -EINVAL is returned when "this" is NULL.

These bugs are found by a static analysis tool STCheck written by us.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>

parent e46131b9

fs/jffs2/nodelist.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -226,7 +226,7 @@ static int jffs2_add_frag_to_fragtree(struct jffs2_sb_info c, struct rb_root r
		lastend = this->ofs + this->size;
		} else {
		dbg_fragtree2("lookup gave no frag\n");
		lastend = 0;
		return -EINVAL;
		}

		/* See if we ran off the end of the fragtree */