Skip to content

Commit 878447c

Browse files
keesvlasakm
authored andcommitted
libsubcmd: Fix use-after-free for realloc(..., 0)
GCC 12 correctly reports a potential use-after-free condition in the xrealloc helper. Fix the warning by avoiding an implicit "free(ptr)" when size == 0: In file included from help.c:12: In function 'xrealloc', inlined from 'add_cmdname' at help.c:24:2: subcmd-util.h:56:23: error: pointer may be used after 'realloc' [-Werror=use-after-free] 56 | ret = realloc(ptr, size); | ^~~~~~~~~~~~~~~~~~ subcmd-util.h:52:21: note: call to 'realloc' here 52 | void *ret = realloc(ptr, size); | ^~~~~~~~~~~~~~~~~~ subcmd-util.h:58:31: error: pointer may be used after 'realloc' [-Werror=use-after-free] 58 | ret = realloc(ptr, 1); | ^~~~~~~~~~~~~~~ subcmd-util.h:52:21: note: call to 'realloc' here 52 | void *ret = realloc(ptr, size); | ^~~~~~~~~~~~~~~~~~ Fixes: 2f4ce5e ("perf tools: Finalize subcmd independence") Reported-by: Valdis Klētnieks <valdis.kletnieks@vt.edu> Signed-off-by: Kees Kook <keescook@chromium.org> Tested-by: Valdis Klētnieks <valdis.kletnieks@vt.edu> Tested-by: Justin M. Forbes <jforbes@fedoraproject.org> Acked-by: Josh Poimboeuf <jpoimboe@redhat.com> Cc: linux-hardening@vger.kernel.org Cc: Valdis Klētnieks <valdis.kletnieks@vt.edu> Link: http://lore.kernel.org/lkml/20220213182443.4037039-1-keescook@chromium.org Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
1 parent f9ef812 commit 878447c

File tree

1 file changed

+2
-9
lines changed

1 file changed

+2
-9
lines changed

tools/lib/subcmd/subcmd-util.h

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -50,15 +50,8 @@ static NORETURN inline void die(const char *err, ...)
5050
static inline void *xrealloc(void *ptr, size_t size)
5151
{
5252
void *ret = realloc(ptr, size);
53-
if (!ret && !size)
54-
ret = realloc(ptr, 1);
55-
if (!ret) {
56-
ret = realloc(ptr, size);
57-
if (!ret && !size)
58-
ret = realloc(ptr, 1);
59-
if (!ret)
60-
die("Out of memory, realloc failed");
61-
}
53+
if (!ret)
54+
die("Out of memory, realloc failed");
6255
return ret;
6356
}
6457

0 commit comments

Comments
 (0)