summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDavid Sterba <dsterba@suse.com>2015-08-26 13:34:39 +0200
committerDavid Sterba <dsterba@suse.com>2015-08-31 19:25:13 +0200
commitbf3639dc625bf5b07a6f30f065fbfa1cfb349869 (patch)
tree69f839a4e73b8b4a70ef6df80496adb54361cbc1
parentf32b82ba9893dd55ae104090668b200887cd78cc (diff)
btrfs-progs: fix use after free in replace start
Commit "btrfs-progs: Add further checks to btrfs replace start command" accesses device size just after its memory is freed. Resolves-coverity-id: 1320425 Signed-off-by: David Sterba <dsterba@suse.com>
-rw-r--r--cmds-replace.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/cmds-replace.c b/cmds-replace.c
index a980305e..9ab8438e 100644
--- a/cmds-replace.c
+++ b/cmds-replace.c
@@ -245,13 +245,13 @@ static int cmd_replace_start(int argc, char **argv)
for (i = 0; i < fi_args.num_devices; i++)
if (start_args.start.srcdevid == di_args[i].devid)
break;
+ srcdev_size = di_args[i].total_bytes;
free(di_args);
if (i == fi_args.num_devices) {
fprintf(stderr, "Error: '%s' is not a valid devid for filesystem '%s'\n",
srcdev, path);
goto leave_with_error;
}
- srcdev_size = di_args[i].total_bytes;
} else if (is_block_device(srcdev) > 0) {
strncpy((char *)start_args.start.srcdev_name, srcdev,
BTRFS_DEVICE_PATH_NAME_MAX);