summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJia-Ju Bai <baijiaju1990@gmail.com>2019-07-24 10:46:58 +0800
committerRichard Weinberger <richard@nod.at>2019-09-15 22:42:10 +0200
commitf2538f999345405f7d2e1194c0c8efa4e11f7b3a (patch)
tree3d7558b9a985024eb9eb80cda548153d5f89c858
parente46131b9fd31155a552dea598e7d915b64c5c04c (diff)
jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()
In jffs2_add_frag_to_fragtree(), there is an if statement on line 223 to check whether "this" is NULL: if (this) When "this" is NULL, it is used at several places, such as on line 249: if (this->node) and on line 260: if (newfrag->ofs > this->ofs) Thus possible null-pointer dereferences may occur. To fix these bugs, -EINVAL is returned when "this" is NULL. These bugs are found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by: Richard Weinberger <richard@nod.at>
-rw-r--r--fs/jffs2/nodelist.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/jffs2/nodelist.c b/fs/jffs2/nodelist.c
index b86c78d178c6..021a4a2190ee 100644
--- a/fs/jffs2/nodelist.c
+++ b/fs/jffs2/nodelist.c
@@ -226,7 +226,7 @@ static int jffs2_add_frag_to_fragtree(struct jffs2_sb_info *c, struct rb_root *r
lastend = this->ofs + this->size;
} else {
dbg_fragtree2("lookup gave no frag\n");
- lastend = 0;
+ return -EINVAL;
}
/* See if we ran off the end of the fragtree */