]> bbs.cooldavid.org Git - net-next-2.6.git/commit
HID: picolcd: Eliminate use after free
authorJulia Lawall <julia@diku.dk>
Sat, 15 May 2010 09:46:36 +0000 (11:46 +0200)
committerJiri Kosina <jkosina@suse.cz>
Mon, 17 May 2010 08:42:37 +0000 (10:42 +0200)
commitaeacb6fd30c800e8229905eac7023777a472d772
treedd4b904cb23f070d05fae452c0d89722b670151b
parent9d71ea057bc4823058d8fe27d34e987eb9880457
HID: picolcd: Eliminate use after free

The skip label frees resp, which has not been allocated at the point of
this goto and then does a break, based on the fact that err is non-zero.
This is replaced by a break directly.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@free@
expression E;
position p;
@@
kfree@p(E)

@@
expression free.E, subE<=free.E, E1;
position free.p;
@@

  kfree@p(E)
  ...
(
  subE = E1
|
* E
)
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
drivers/hid/hid-picolcd.c