Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c6c6f30b authored by Eric Biggers's avatar Eric Biggers Committed by Automerger Merge Worker
Browse files

Merge "libsparse: fix double free after block splitting" am: aa70ac10 

Original change: https://android-review.googlesource.com/c/platform/system/core/+/2506666



Change-Id: Ib71ec037449820efff80d112dcbbcf84a2ef38e2
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents f9bfa851 aa70ac10

libsparse/backed_block.cpp

+11 −2
Original line number Diff line number Diff line
@@ -315,6 +315,10 @@ int backed_block_add_file(struct backed_block_list* bbl, const char* filename, i 
  bb->len = len;

  bb->type = BACKED_BLOCK_FILE;

  bb->file.filename = strdup(filename);

  if (!bb->file.filename) {

    free(bb);

    return -ENOMEM;

  }

  bb->file.offset = offset;

  bb->next = nullptr;
@@ -359,14 +363,17 @@ int backed_block_split(struct backed_block_list* bbl, struct backed_block* bb, 
  new_bb->len = bb->len - max_len;

  new_bb->block = bb->block + max_len / bbl->block_size;

  new_bb->next = bb->next;

  bb->next = new_bb;

  bb->len = max_len;



  switch (bb->type) {

    case BACKED_BLOCK_DATA:

      new_bb->data.data = (char*)bb->data.data + max_len;

      break;

    case BACKED_BLOCK_FILE:

      new_bb->file.filename = strdup(bb->file.filename);

      if (!new_bb->file.filename) {

        free(new_bb);

        return -ENOMEM;

      }

      new_bb->file.offset += max_len;

      break;

    case BACKED_BLOCK_FD:
@@ -376,5 +383,7 @@ int backed_block_split(struct backed_block_list* bbl, struct backed_block* bb, 
      break;

  }



  bb->next = new_bb;

  bb->len = max_len;

  return 0;

}