luo980/libuv
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

zos: fix scandir() error path NULL pointer deref

Browse Source 
Commit b5155dd2 ("zos: return on realloc failure in scandir()")
introduced a bug where `nl` is dereferenced when it's NULL after
reallocation fails.

PR-URL: https://github.com/libuv/libuv/pull/2734
Refs: https://github.com/libuv/libuv/pull/2693
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
This commit is contained in:
Ben Noordhuis 2020-03-10 11:36:47 +01:00
parent b5155dd2ac
commit a9974da019
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/unix/os390-syscalls.c
View File

@ -43,6 +43,7 @@ int scandir(const char* maindir, struct dirent*** namelist,
int (*compar)(const struct dirent**,
const struct dirent **)) {
struct dirent** nl;
struct dirent** nl_copy;
struct dirent* dirent;
unsigned count;
size_t allocated;
@ -66,11 +67,13 @@ int scandir(const char* maindir, struct dirent*** namelist,
goto error;
memcpy(copy, dirent, sizeof(*copy));
nl = uv__realloc(nl, sizeof(*copy) * (count + 1));
if (nl == NULL) {
nl_copy = uv__realloc(nl, sizeof(*copy) * (count + 1));
if (nl_copy == NULL) {
uv__free(copy);
goto error;
}
nl = nl_copy;
nl[count++] = copy;
}
}