Em Tue, Jul 02, 2019 at 06:34:13PM +0800, Leo Yan escreveu:
> Based on the following report from Smatch, fix the potential
> dereferencing freed memory check.
>
> tools/perf/util/annotate.c:1125
> disasm_line__parse() error: dereferencing freed memory 'namep'
>
> tools/perf/util/annotate.c
> 1100 static int disasm_line__parse(char *line, const char **namep, char
> **rawp)
> 1101 {
> 1102 char tmp, *name = ltrim(line);
>
> [...]
>
> 1114 *namep = strdup(name);
> 1115
> 1116 if (*namep == NULL)
> 1117 goto out_free_name;
>
> [...]
>
> 1124 out_free_name:
> 1125 free((void *)namep);
> ^^^^^
> 1126 *namep = NULL;
> ^^^^^^
> 1127 return -1;
> 1128 }
>
> If strdup() fails to allocate memory space for *namep, we don't need to
> free memory with pointer 'namep', which is resident in data structure
> disasm_line::ins::name; and *namep is NULL pointer for this failure, so
> it's pointless to assign NULL to *namep again.
Applied, with this extra comment:
Committer note:
Freeing namep, which is the address of the first entry of the 'struct
ins' that is the first member of struct disasm_line would in fact free
that disasm_line instance, if it was allocated via malloc/calloc, which,
later, would a dereference of freed memory.
