From 3c6e113f2631bd15a816ed83fd409b304981641e Mon Sep 17 00:00:00 2001 From: Patrick Georgi Date: Fri, 29 Jul 2016 16:36:23 +0200 Subject: [PATCH] UPSTREAM: libpayload: fix leak in libcbfs stage wasn't freed on errors. BUG=None BRANCH=None TEST=None Change-Id: Ie1e30ec043e4ed817dbe758f0fe217796f9da8ef Signed-off-by: Patrick Georgi Found-by: Coverity Scan #1347345 Reviewed-on: https://review.coreboot.org/15958 Tested-by: build bot (Jenkins) Reviewed-by: Paul Menzel Reviewed-by: Duncan Laurie Reviewed-on: https://chromium-review.googlesource.com/366293 Commit-Ready: Furquan Shaikh Tested-by: Furquan Shaikh Reviewed-by: Furquan Shaikh --- payloads/libpayload/libcbfs/cbfs.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/payloads/libpayload/libcbfs/cbfs.c b/payloads/libpayload/libcbfs/cbfs.c index 38b1ff8c71..3cce799fe3 100644 --- a/payloads/libpayload/libcbfs/cbfs.c +++ b/payloads/libpayload/libcbfs/cbfs.c @@ -116,8 +116,10 @@ void * cbfs_load_stage(struct cbfs_media *media, const char *name) sizeof(struct cbfs_stage), (void *) (uintptr_t) stage->load, stage->len); - if (!final_size) - return (void *) -1; + if (!final_size) { + entry = -1; + goto out; + } memset((void *)((uintptr_t)stage->load + final_size), 0, stage->memlen - final_size); @@ -127,6 +129,7 @@ void * cbfs_load_stage(struct cbfs_media *media, const char *name) entry = stage->entry; // entry = ntohll(stage->entry); +out: free(stage); return (void *) entry; }