Skip to content

Commit 7d1e551

Browse files
Zepp-HanzjRbb666
authored andcommitted
[dfs] Fix path buffer leaks in utimensat
1 parent 9fce24b commit 7d1e551

1 file changed

Lines changed: 26 additions & 19 deletions

File tree

components/dfs/dfs_v2/src/dfs_posix.c

Lines changed: 26 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -157,9 +157,10 @@ int utimensat(int __fd, const char *__path, const struct timespec __times[2], in
157157
struct stat buffer;
158158
struct dfs_file *d;
159159
char *fullpath;
160+
char *allocated_path = RT_NULL;
160161
struct dfs_attr attr;
161162
time_t current_time;
162-
char *link_fn = (char *)rt_malloc(DFS_PATH_MAX);
163+
char *link_fn = RT_NULL;
163164
int err;
164165

165166
if (__path == NULL)
@@ -188,12 +189,13 @@ int utimensat(int __fd, const char *__path, const struct timespec __times[2], in
188189
return -EBADF;
189190
}
190191

191-
fullpath = dfs_dentry_full_path(d->dentry);
192-
if (!fullpath)
192+
allocated_path = dfs_dentry_full_path(d->dentry);
193+
if (!allocated_path)
193194
{
194195
rt_set_errno(-ENOMEM);
195196
return -1;
196197
}
198+
fullpath = allocated_path;
197199
}
198200
}
199201

@@ -230,30 +232,35 @@ int utimensat(int __fd, const char *__path, const struct timespec __times[2], in
230232
{
231233
if (S_ISLNK(buffer.st_mode) && (__flags != AT_SYMLINK_NOFOLLOW))
232234
{
233-
if (link_fn)
235+
link_fn = (char *)rt_malloc(DFS_PATH_MAX);
236+
if (!link_fn)
234237
{
235-
err = dfs_file_readlink(fullpath, link_fn, DFS_PATH_MAX);
236-
if (err < 0)
237-
{
238-
rt_free(link_fn);
239-
return -ENOENT;
240-
}
241-
else
242-
{
243-
fullpath = link_fn;
244-
if (dfs_file_stat(fullpath, &buffer) != 0)
245-
{
246-
rt_free(link_fn);
247-
return -ENOENT;
248-
}
249-
}
238+
rt_set_errno(-ENOMEM);
239+
ret = -1;
240+
goto exit;
250241
}
251242

243+
err = dfs_file_readlink(fullpath, link_fn, DFS_PATH_MAX);
244+
if (err < 0)
245+
{
246+
ret = -ENOENT;
247+
goto exit;
248+
}
249+
250+
fullpath = link_fn;
251+
if (dfs_file_stat(fullpath, &buffer) != 0)
252+
{
253+
ret = -ENOENT;
254+
goto exit;
255+
}
252256
}
253257
}
254258
attr.st_mode = buffer.st_mode;
255259
ret = dfs_file_setattr(fullpath, &attr);
260+
261+
exit:
256262
rt_free(link_fn);
263+
rt_free(allocated_path);
257264

258265
return ret;
259266
}

0 commit comments

Comments
 (0)