mirrors/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2025-11-04 18:49:34 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()

Browse source 
In jffs2_add_frag_to_fragtree(), there is an if statement on line 223 to
check whether "this" is NULL:
    if (this)

When "this" is NULL, it is used at several places, such as on line 249:
    if (this->node)
and on line 260:
    if (newfrag->ofs > this->ofs)

Thus possible null-pointer dereferences may occur.

To fix these bugs, -EINVAL is returned when "this" is NULL.

These bugs are found by a static analysis tool STCheck written by us.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
This commit is contained in:
Jia-Ju Bai 2019-07-24 10:46:58 +08:00 committed by Richard Weinberger
parent e46131b9fd
commit f2538f9993
1 changed files with 1 additions and 1 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

2
fs/jffs2/nodelist.c
View file

@ -226,7 +226,7 @@ static int jffs2_add_frag_to_fragtree(struct jffs2_sb_info *c, struct rb_root *r
lastend = this->ofs + this->size; lastend = this->ofs + this->size;
} else { } else {
dbg_fragtree2("lookup gave no frag\n"); dbg_fragtree2("lookup gave no frag\n");
lastend = 0; return -EINVAL;
} }
/* See if we ran off the end of the fragtree */ /* See if we ran off the end of the fragtree */