mirror of
https://github.com/systemd/systemd-stable.git
synced 2024-10-27 18:55:09 +03:00
Never call unmap with MAP_FAILED. (#5590)
When mmap is called, the code in correctly checks for p == MAP_FAILED. But the resource cleanup at the end of busname_peek_message checks for p == NULL, and if that's not true, munmap is called. Therefore in error case, munmap is called with a MAP_FAILED argument which can result in unexpected behaviour depending on sz's value. Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
This commit is contained in:
parent
6f94e420e8
commit
ff8017c4a2
@ -764,7 +764,7 @@ static int busname_peek_message(BusName *n) {
|
|||||||
struct kdbus_item *d;
|
struct kdbus_item *d;
|
||||||
struct kdbus_msg *k;
|
struct kdbus_msg *k;
|
||||||
size_t start, ps, sz, delta;
|
size_t start, ps, sz, delta;
|
||||||
void *p = NULL;
|
void *p = MAP_FAILED;
|
||||||
pid_t pid = 0;
|
pid_t pid = 0;
|
||||||
int r;
|
int r;
|
||||||
|
|
||||||
@ -825,7 +825,7 @@ static int busname_peek_message(BusName *n) {
|
|||||||
r = 0;
|
r = 0;
|
||||||
|
|
||||||
finish:
|
finish:
|
||||||
if (p)
|
if (p != MAP_FAILED)
|
||||||
(void) munmap(p, sz);
|
(void) munmap(p, sz);
|
||||||
|
|
||||||
cmd_free.offset = cmd_recv.msg.offset;
|
cmd_free.offset = cmd_recv.msg.offset;
|
||||||
|
Loading…
Reference in New Issue
Block a user