summaryrefslogtreecommitdiff
path: root/tools/lib
diff options
context:
space:
mode:
authorIan Rogers <irogers@google.com>2023-07-07 16:09:26 -0700
committerArnaldo Carvalho de Melo <acme@redhat.com>2023-07-11 16:44:12 -0300
commit4b96679170c63be361d1b0fdeb81bb0ef207dbcb (patch)
treecea23fa42d5b416e4f2c000625d36b3b21779d73 /tools/lib
parentad07149f34dbb3e0f4e25e19ef80bdd3216ba1cf (diff)
libsubcmd: Avoid SEGV/use-after-free when commands aren't excluded
The array shortening may perform unnecessary array copies. Before commit 657a3efee43a ("lib subcmd: Avoid memory leak in exclude_cmds") this was benign, but afterwards this could lead to a SEGV. Fixes: 657a3efee43a29d1 ("lib subcmd: Avoid memory leak in exclude_cmds") Signed-off-by: Ian Rogers <irogers@google.com> Acked-by: Namhyung Kim <namhyung@kernel.org> Cc: Chenyuan Mi <cymi20@fudan.edu.cn> Cc: Ian Rogers <irogers@google.com> Link: https://lore.kernel.org/r/20230707230926.841086-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Diffstat (limited to 'tools/lib')
-rw-r--r--tools/lib/subcmd/help.c18
1 files changed, 12 insertions, 6 deletions
diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c
index 67a8d6b740ea..adfbae27dc36 100644
--- a/tools/lib/subcmd/help.c
+++ b/tools/lib/subcmd/help.c
@@ -68,8 +68,13 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
while (ci < cmds->cnt && ei < excludes->cnt) {
cmp = strcmp(cmds->names[ci]->name, excludes->names[ei]->name);
if (cmp < 0) {
- zfree(&cmds->names[cj]);
- cmds->names[cj++] = cmds->names[ci++];
+ if (ci == cj) {
+ ci++;
+ cj++;
+ } else {
+ zfree(&cmds->names[cj]);
+ cmds->names[cj++] = cmds->names[ci++];
+ }
} else if (cmp == 0) {
ci++;
ei++;
@@ -77,10 +82,11 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
ei++;
}
}
-
- while (ci < cmds->cnt) {
- zfree(&cmds->names[cj]);
- cmds->names[cj++] = cmds->names[ci++];
+ if (ci != cj) {
+ while (ci < cmds->cnt) {
+ zfree(&cmds->names[cj]);
+ cmds->names[cj++] = cmds->names[ci++];
+ }
}
for (ci = cj; ci < cmds->cnt; ci++)
zfree(&cmds->names[ci]);