[systemd-commits] 4 commits - src/core src/libsystemd-network src/shared src/udev

[Tom Gundersen]

 src/core/killall.c                      |    2 +-
 src/libsystemd-network/sd-dhcp-client.c |    2 +-
 src/shared/install.c                    |    2 +-
 src/udev/net/link-config.c              |    2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

New commits:
commit 223217749e57996336d5730b0a28716cca56d45d
Author: Andreas Henriksson <andreas at fatal.se>
Date:   Fri Jun 13 18:48:18 2014 +0200

    install: fix invalid free() in unit_file_mask()
    
    int unit_file_mask(...) in ./src/shared/install.c calls
    get_config_path(...) which can in 4 error cases return without setting
    "ret", and thus "prefix" can be uninitialized when unit_file_mask(...)
    finishes (which it does directly after the error is returned from
    get_config_path(...)).

diff --git a/src/shared/install.c b/src/shared/install.c
index 487d0f6..f562063 100644
--- a/src/shared/install.c
+++ b/src/shared/install.c
@@ -563,7 +563,7 @@ int unit_file_mask(
                 unsigned *n_changes) {
 
         char **i;
-        _cleanup_free_ char *prefix;
+        _cleanup_free_ char *prefix = NULL;
         int r;
 
         assert(scope >= 0);

commit f8a0bb5285024b6ce372c3157e761e6543ebdcd2
Author: Andreas Henriksson <andreas at fatal.se>
Date:   Fri Jun 13 18:48:21 2014 +0200

    udev: fix invalid free() in enable_name_policy()
    
    static bool enable_name_policy(...) in ./src/udev/net/link-config.c
    calls proc_cmdline(...) to get "line" initialized, but
    proc_cmdline(...) does not guarantee that atleast when both
    conditions (detect_container(NULL) > 0) and
    read_full_file(...) returned < 0.

diff --git a/src/udev/net/link-config.c b/src/udev/net/link-config.c
index a9acc3d..7a9d01b 100644
--- a/src/udev/net/link-config.c
+++ b/src/udev/net/link-config.c
@@ -185,7 +185,7 @@ static int load_link(link_config_ctx *ctx, const char *filename) {
 }
 
 static bool enable_name_policy(void) {
-        _cleanup_free_ char *line;
+        _cleanup_free_ char *line = NULL;
         char *w, *state;
         int r;
         size_t l;

commit 3e09eb5c83e56bc0184bd9d9c44f76047464f77c
Author: Andreas Henriksson <andreas at fatal.se>
Date:   Fri Jun 13 18:48:19 2014 +0200

    core: fix invalid free() in killall()
    
    static int killall(....) in ./src/core/killall.c tries to get "s"
    initialized by calling get_process_comm(...) which calls
    read_one_line_file(...) which if it fails will mean it is left
    uninitialized.
    It is then used in argument to strna(s) call where it is
    dereferenced(!), in addition to nothing else initializing it before
    the scope it is in finishes.

diff --git a/src/core/killall.c b/src/core/killall.c
index 57ed41c..eab48f7 100644
--- a/src/core/killall.c
+++ b/src/core/killall.c
@@ -168,7 +168,7 @@ static int killall(int sig, Set *pids, bool send_sighup) {
                         continue;
 
                 if (sig == SIGKILL) {
-                        _cleanup_free_ char *s;
+                        _cleanup_free_ char *s = NULL;
 
                         get_process_comm(pid, &s);
                         log_notice("Sending SIGKILL to PID "PID_FMT" (%s).", pid, strna(s));

commit 8186d9dda0d3f8a853afe6fdbd605f42151fe165
Author: Andreas Henriksson <andreas at fatal.se>
Date:   Fri Jun 13 18:48:20 2014 +0200

    sd-dhcp-client: fix invalid free() in client_send_request()
    
    static int client_send_request(...) in
    ./src/libsystemd-network/sd-dhcp-client.c tries to initialize
    "request" by calling client_message_init(...), which has atleast
    5 error cases where it can return without that happening.
    This leads to the function finishing without "request" being initialized.

diff --git a/src/libsystemd-network/sd-dhcp-client.c b/src/libsystemd-network/sd-dhcp-client.c
index 8f54906..2a46624 100644
--- a/src/libsystemd-network/sd-dhcp-client.c
+++ b/src/libsystemd-network/sd-dhcp-client.c
@@ -413,7 +413,7 @@ static int client_send_discover(sd_dhcp_client *client) {
 }
 
 static int client_send_request(sd_dhcp_client *client) {
-        _cleanup_free_ DHCPPacket *request;
+        _cleanup_free_ DHCPPacket *request = NULL;
         size_t optoffset, optlen;
         int r;