From: Andrei Borzenkov <arvidjaar@gmail.com>
Date: Mon, 1 Dec 2014 18:23:54 +0000 (+0300)
Subject: grub-core/loader/i386/xen_fileXX.c: memory leak in grub_xen_get_infoXX
X-Git-Tag: 2.02-beta3~595
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3173c7501ccc02e1475261404fc8b0199be6314e;p=thirdparty%2Fgrub.git

grub-core/loader/i386/xen_fileXX.c: memory leak in grub_xen_get_infoXX

CID: 73645, 73782
---

diff --git a/ChangeLog b/ChangeLog
index dd44cd8a5..46f049d48 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,7 @@
 2014-12-01  Andrei Borzenkov  <arvidjaar@gmail.com>
 
+	* grub-core/loader/i386/xen_fileXX.c (grub_xen_get_infoXX): Fix
+	memory leak (CID 73645, 73782).
 	* grub-core/fs/zfs/zfsinfo.c (print_vdev_info): Fix memory leak
 	(CID 73635).
 
diff --git a/grub-core/loader/i386/xen_fileXX.c b/grub-core/loader/i386/xen_fileXX.c
index 73a5f90fd..1ba5649e2 100644
--- a/grub-core/loader/i386/xen_fileXX.c
+++ b/grub-core/loader/i386/xen_fileXX.c
@@ -311,14 +311,19 @@ grub_xen_get_infoXX (grub_elf_t elf, struct grub_xen_file_info *xi)
     return grub_errno;
 
   if (grub_file_seek (elf->file, elf->ehdr.ehdrXX.e_shoff) == (grub_off_t) -1)
-    return grub_errno;
+    {
+      err = grub_errno;
+      goto cleanup;
+    }
 
   if (grub_file_read (elf->file, s0, shsize) != (grub_ssize_t) shsize)
     {
       if (grub_errno)
-	return grub_errno;
-      return grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"),
+	err = grub_errno;
+      else
+	err = grub_error (GRUB_ERR_BAD_OS, N_("premature end of file %s"),
 			 elf->file->name);
+      goto cleanup;
     }
 
   s = (Elf_Shdr *) ((char *) s0 + elf->ehdr.ehdrXX.e_shstrndx * shentsize);
@@ -330,18 +335,29 @@ grub_xen_get_infoXX (grub_elf_t elf, struct grub_xen_file_info *xi)
       char name[sizeof("__xen_guest")];
       grub_memset (name, 0, sizeof (name));
       if (grub_file_seek (elf->file, stroff + s->sh_name) == (grub_off_t) -1)
-	return grub_errno;
+	{
+	  err = grub_errno;
+	  goto cleanup;
+	}
 
       if (grub_file_read (elf->file, name, sizeof (name)) != (grub_ssize_t) sizeof (name))
 	{
 	  if (grub_errno)
-	    return grub_errno;
+	    {
+	      err = grub_errno;
+	      goto cleanup;
+	    }
 	  continue;
 	}
       if (grub_memcmp (name, "__xen_guest",
 		       sizeof("__xen_guest")) != 0)
 	continue;
-      return parse_xen_guest (elf, xi, s->sh_offset, s->sh_size);
+      err = parse_xen_guest (elf, xi, s->sh_offset, s->sh_size);
+      goto cleanup;
     }
-  return grub_error (GRUB_ERR_BAD_OS, "no XEN note found");
+  err = grub_error (GRUB_ERR_BAD_OS, "no XEN note found");
+
+cleanup:
+  grub_free (s0);
+  return err;
 }