util-linux/backport-libfdisk-another-parse_line-nameval-cleanup.patch
yang_zhuang_zhuang 47ec069fb2 Fix memleak in fdisk_script_read_file
Fix heap-buffer-overflow in fdisk_partname
Fix integer overflow in partno_from_devname
2021-03-01 19:09:35 +08:00

64 lines
1.7 KiB
Diff

From d8f35960ae0daa5d8b8231d22a6e967f5fcadb31 Mon Sep 17 00:00:00 2001
From: Karel Zak <kzak@redhat.com>
Date: Thu, 13 Aug 2020 10:13:01 +0200
Subject: [PATCH] libfdisk: another parse_line_nameval() cleanup
---
libfdisk/src/script.c | 23 +++++++++++++----------
1 file changed, 13 insertions(+), 10 deletions(-)
diff --git a/libfdisk/src/script.c b/libfdisk/src/script.c
index 81d425945..4d9835f59 100644
--- a/libfdisk/src/script.c
+++ b/libfdisk/src/script.c
@@ -939,7 +939,7 @@ static int next_number(char **s, uint64_t *num, int *power)
static int next_string(char **s, char **str)
{
- char *tk;
+ char *tk, *p = NULL;
int rc = -EINVAL;
assert(s);
@@ -947,9 +947,11 @@ static int next_string(char **s, char **str)
tk = next_token(s);
if (tk) {
- *str = strdup(tk);
- rc = !*str ? -ENOMEM : 0;
+ p = strdup(tk);
+ rc = p ? 0 : -ENOMEM;
}
+
+ *str = p;
return rc;
}
@@ -1086,18 +1088,19 @@ static int parse_line_nameval(struct fdisk_script *dp, char *s)
!strncasecmp(p, "Id=", 3)) { /* backward compatibility */
char *type = NULL;
+ fdisk_unref_parttype(pa->type);
+ pa->type = NULL;
+
p += ((*p == 'I' || *p == 'i') ? 3 : 5); /* "Id=", "type=" */
rc = next_string(&p, &type);
- if (rc)
- break;
-
- fdisk_unref_parttype(pa->type);
- pa->type = fdisk_label_advparse_parttype(script_get_label(dp),
+ if (rc == 0) {
+ pa->type = fdisk_label_advparse_parttype(script_get_label(dp),
type, FDISK_SCRIPT_PARTTYPE_PARSE_FLAGS);
+ if (!pa->type)
+ rc = -EINVAL;
+ }
free(type);
- if (!pa->type)
- rc = -EINVAL;
} else {
DBG(SCRIPT, ul_debugobj(dp, "script parse error: unknown field '%s'", p));
rc = -EINVAL;