Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit da319194 authored by Eric Biggers's avatar Eric Biggers Committed by Automerger Merge Worker
Browse files

Merge "libsparse: fix double free after block splitting" am: aa70ac10 am:... 

Merge "libsparse: fix double free after block splitting" am: aa70ac10 am: c6c6f30b am: c53e690a

Original change: https://android-review.googlesource.com/c/platform/system/core/+/2506666



Change-Id: I923d604569a217d53b3499b8c3e0c669f989d52a
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents a3863295 c53e690a

libsparse/backed_block.cpp

+11 −2
Original line number Original line Diff line number Diff line
@@ -315,6 +315,10 @@ int backed_block_add_file(struct backed_block_list* bbl, const char* filename, i 
  bb->len = len;

  bb->len = len;

  bb->type = BACKED_BLOCK_FILE;

  bb->type = BACKED_BLOCK_FILE;

  bb->file.filename = strdup(filename);

  bb->file.filename = strdup(filename);

  if (!bb->file.filename) {

    free(bb);

    return -ENOMEM;

  }

  bb->file.offset = offset;

  bb->file.offset = offset;

  bb->next = nullptr;

  bb->next = nullptr;
@@ -359,14 +363,17 @@ int backed_block_split(struct backed_block_list* bbl, struct backed_block* bb, 
  new_bb->len = bb->len - max_len;

  new_bb->len = bb->len - max_len;

  new_bb->block = bb->block + max_len / bbl->block_size;

  new_bb->block = bb->block + max_len / bbl->block_size;

  new_bb->next = bb->next;

  new_bb->next = bb->next;

  bb->next = new_bb;

  bb->len = max_len;





  switch (bb->type) {

  switch (bb->type) {

    case BACKED_BLOCK_DATA:

    case BACKED_BLOCK_DATA:

      new_bb->data.data = (char*)bb->data.data + max_len;

      new_bb->data.data = (char*)bb->data.data + max_len;

      break;

      break;

    case BACKED_BLOCK_FILE:

    case BACKED_BLOCK_FILE:

      new_bb->file.filename = strdup(bb->file.filename);

      if (!new_bb->file.filename) {

        free(new_bb);

        return -ENOMEM;

      }

      new_bb->file.offset += max_len;

      new_bb->file.offset += max_len;

      break;

      break;

    case BACKED_BLOCK_FD:

    case BACKED_BLOCK_FD:
@@ -376,5 +383,7 @@ int backed_block_split(struct backed_block_list* bbl, struct backed_block* bb, 
      break;

      break;

  }

  }





  bb->next = new_bb;

  bb->len = max_len;

  return 0;

  return 0;

}
 
}