Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4ff5ff29 authored by George Burgess IV's avatar George Burgess IV
Browse files

libsync: Fix a double-free. 

sync_file_info, the only caller of legacy_fence_info_to_sync_file_info,
unconditionally frees legacy_info after
legacy_fence_info_to_sync_file_info is called. So, if this calloc
fails, we'll end up freeing legacy_info twice.

Bug: 27101951
Test: mma. Static analyzer complaint about double-free is gone.
Change-Id: I43bf820af9aadf30cb8eabce57416f69a8fccf89
parent f899548c

libsync/sync.c

+0 −1
Original line number Diff line number Diff line
@@ -275,7 +275,6 @@ static struct sync_file_info* legacy_fence_info_to_sync_file_info( 
    info = calloc(1, sizeof(struct sync_file_info) +

                     num_fences * sizeof(struct sync_fence_info));

    if (!info) {

        free(legacy_info);

        return NULL;

    }

    info->sync_fence_info = (__u64)(uintptr_t)(info + 1);