diff options
| author | George Burgess IV <gbiv@google.com> | 2017-09-05 16:26:36 -0700 |
|---|---|---|
| committer | George Burgess IV <gbiv@google.com> | 2017-09-05 16:26:36 -0700 |
| commit | 4ff5ff29d26cd028d5d78f5b764dab380fd7c9f4 (patch) | |
| tree | 283434227e4125590c2e3cd0346b6394854cb685 /libsync | |
| parent | f899548cdb18a56db9ad0c0c5ecd1941a6b23255 (diff) | |
| download | system_core-4ff5ff29d26cd028d5d78f5b764dab380fd7c9f4.tar.gz system_core-4ff5ff29d26cd028d5d78f5b764dab380fd7c9f4.tar.bz2 system_core-4ff5ff29d26cd028d5d78f5b764dab380fd7c9f4.zip | |
libsync: Fix a double-free.
sync_file_info, the only caller of legacy_fence_info_to_sync_file_info,
unconditionally frees legacy_info after
legacy_fence_info_to_sync_file_info is called. So, if this calloc
fails, we'll end up freeing legacy_info twice.
Bug: 27101951
Test: mma. Static analyzer complaint about double-free is gone.
Change-Id: I43bf820af9aadf30cb8eabce57416f69a8fccf89
Diffstat (limited to 'libsync')
| -rw-r--r-- | libsync/sync.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/libsync/sync.c b/libsync/sync.c index baeccda47..e65765894 100644 --- a/libsync/sync.c +++ b/libsync/sync.c @@ -275,7 +275,6 @@ static struct sync_file_info* legacy_fence_info_to_sync_file_info( info = calloc(1, sizeof(struct sync_file_info) + num_fences * sizeof(struct sync_fence_info)); if (!info) { - free(legacy_info); return NULL; } info->sync_fence_info = (__u64)(uintptr_t)(info + 1); |