diff options
author | David Sterba <dsterba@suse.com> | 2015-08-26 13:34:39 +0200 |
---|---|---|
committer | David Sterba <dsterba@suse.com> | 2015-08-31 19:25:13 +0200 |
commit | bf3639dc625bf5b07a6f30f065fbfa1cfb349869 (patch) | |
tree | 69f839a4e73b8b4a70ef6df80496adb54361cbc1 | |
parent | f32b82ba9893dd55ae104090668b200887cd78cc (diff) |
btrfs-progs: fix use after free in replace start
Commit "btrfs-progs: Add further checks to btrfs replace start command"
accesses device size just after its memory is freed.
Resolves-coverity-id: 1320425
Signed-off-by: David Sterba <dsterba@suse.com>
-rw-r--r-- | cmds-replace.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/cmds-replace.c b/cmds-replace.c index a980305e..9ab8438e 100644 --- a/cmds-replace.c +++ b/cmds-replace.c @@ -245,13 +245,13 @@ static int cmd_replace_start(int argc, char **argv) for (i = 0; i < fi_args.num_devices; i++) if (start_args.start.srcdevid == di_args[i].devid) break; + srcdev_size = di_args[i].total_bytes; free(di_args); if (i == fi_args.num_devices) { fprintf(stderr, "Error: '%s' is not a valid devid for filesystem '%s'\n", srcdev, path); goto leave_with_error; } - srcdev_size = di_args[i].total_bytes; } else if (is_block_device(srcdev) > 0) { strncpy((char *)start_args.start.srcdev_name, srcdev, BTRFS_DEVICE_PATH_NAME_MAX); |