Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 11a7ac23 authored by Jim Meyering's avatar Jim Meyering Committed by Linus Torvalds
Browse files

uml: improved error handling while locating temp dir 



* arch/um/os-Linux/mem.c (make_tempfile): Don't deref NULL upon failed malloc.

* arch/um/os-Linux/mem.c (make_tempfile): Handle NULL tempdir.
Don't let a long tempdir (e.g., via TMPDIR) provoke heap corruption.

[ jdike - formatting cleanups, deleted obsolete comment ]

Signed-off-by: default avatarJim Meyering <meyering@redhat.com>
Signed-off-by: default avatarJeff Dike <jdike@linux.intel.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 5134d8fe

arch/um/os-Linux/mem.c

+6 −9
Original line number Diff line number Diff line
@@ -162,11 +162,6 @@ static void which_tmpdir(void) 
	goto out;

}



/*

 * This proc still used in tt-mode

 * (file: kernel/tt/ptproxy/proxy.c, proc: start_debugger).

 * So it isn't 'static' yet.

 */

static int __init make_tempfile(const char *template, char **out_tempname,

				int do_unlink)

{
@@ -175,10 +170,13 @@ static int __init make_tempfile(const char *template, char **out_tempname, 


	which_tmpdir();

	tempname = malloc(MAXPATHLEN);

	if (!tempname)

		goto out;

	if (tempname == NULL)

		return -1;



	find_tempdir();

	if ((tempdir == NULL) || (strlen(tempdir) >= MAXPATHLEN))

		return -1;



	if (template[0] != '/')

		strcpy(tempname, tempdir);

	else
@@ -196,9 +194,8 @@ static int __init make_tempfile(const char *template, char **out_tempname, 
	}

	if (out_tempname) {

		*out_tempname = tempname;

	} else {

	} else

		free(tempname);

	}

	return fd;

out:

	free(tempname);