77c23f
From bcb6107f98d7b1edf687d7afd552a4528b7e673b Mon Sep 17 00:00:00 2001
77c23f
From: jmaloy <jmaloy@redhat.com>
77c23f
Date: Tue, 12 May 2020 21:15:13 +0100
77c23f
Subject: [PATCH 2/7] Don't leak memory when reallocation fails.
77c23f
MIME-Version: 1.0
77c23f
Content-Type: text/plain; charset=UTF-8
77c23f
Content-Transfer-Encoding: 8bit
77c23f
77c23f
RH-Author: jmaloy <jmaloy@redhat.com>
77c23f
Message-id: <20200512211514.1398384-2-jmaloy@redhat.com>
77c23f
Patchwork-id: 96412
77c23f
O-Subject: [RHEL-AV-8.2.1 qemu-kvm PATCH 1/2] Don't leak memory when reallocation fails.
77c23f
Bugzilla: 1749737
77c23f
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
77c23f
RH-Acked-by: Thomas Huth <thuth@redhat.com>
77c23f
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
77c23f
77c23f
From: Jindrich Novy <jnovy@redhat.com>
77c23f
77c23f
Signed-off-by: Jindrich Novy <jnovy@redhat.com>
77c23f
[ Marc-André - modified to use a temporary variable ]
77c23f
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
77c23f
(cherry picked from libslirp commit d171af3732a0610a25334b06b77fa547bd677918)
77c23f
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
77c23f
77c23f
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
77c23f
---
77c23f
 slirp/src/sbuf.c | 11 +++++++----
77c23f
 1 file changed, 7 insertions(+), 4 deletions(-)
77c23f
77c23f
diff --git a/slirp/src/sbuf.c b/slirp/src/sbuf.c
77c23f
index abced48..0569c34 100644
77c23f
--- a/slirp/src/sbuf.c
77c23f
+++ b/slirp/src/sbuf.c
77c23f
@@ -39,13 +39,16 @@ void sbreserve(struct sbuf *sb, int size)
77c23f
     if (sb->sb_data) {
77c23f
         /* Already alloced, realloc if necessary */
77c23f
         if (sb->sb_datalen != size) {
77c23f
-            sb->sb_wptr = sb->sb_rptr = sb->sb_data =
77c23f
-                (char *)realloc(sb->sb_data, size);
77c23f
+            char *new = realloc(sb->sb_data, size);
77c23f
             sb->sb_cc = 0;
77c23f
-            if (sb->sb_wptr)
77c23f
+            if (new) {
77c23f
+                sb->sb_data = sb->sb_wptr = sb->sb_rptr = new;
77c23f
                 sb->sb_datalen = size;
77c23f
-            else
77c23f
+            } else {
77c23f
+                free(sb->sb_data);
77c23f
+                sb->sb_data = sb->sb_wptr = sb->sb_rptr = NULL;
77c23f
                 sb->sb_datalen = 0;
77c23f
+            }
77c23f
         }
77c23f
     } else {
77c23f
         sb->sb_wptr = sb->sb_rptr = sb->sb_data = (char *)malloc(size);
77c23f
-- 
77c23f
1.8.3.1
77c23f