From 564958f92711e5239ee4240213a2b59ce0349c18 Mon Sep 17 00:00:00 2001 From: Jef Driesen Date: Thu, 28 Jun 2018 08:43:02 +0200 Subject: [PATCH] Fix an uninitialized variable In the error handling code, the dc_buffer_free() function can be called with an unitialized "buffer" variable as parameter. Fixed by adding an extra label. Reported-By: Linus Torvalds --- src/tecdiving_divecomputereu.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/src/tecdiving_divecomputereu.c b/src/tecdiving_divecomputereu.c index bb2a35d..66d2117 100644 --- a/src/tecdiving_divecomputereu.c +++ b/src/tecdiving_divecomputereu.c @@ -463,27 +463,27 @@ tecdiving_divecomputereu_device_foreach (dc_device_t *abstract, dc_dive_callback status = tecdiving_divecomputereu_send (device, CMD_LIST, NULL, 0); if (status != DC_STATUS_SUCCESS) { ERROR (abstract->context, "Failed to send the list command."); - goto error_free; + goto error_logbook_free; } // Read the dive list. status = tecdiving_divecomputereu_receive (device, RSP_LIST, logbook, length, &length); if (status != DC_STATUS_SUCCESS) { ERROR (abstract->context, "Failed to receive the logbook."); - goto error_free; + goto error_logbook_free; } // Verify the minimum length. if (length < 2) { status = DC_STATUS_DATAFORMAT; - goto error_free; + goto error_logbook_free; } // Get the number of logbook entries. unsigned int nlogbooks = array_uint16_be (logbook); if (length != 2 + nlogbooks * SZ_SUMMARY) { status = DC_STATUS_DATAFORMAT; - goto error_free; + goto error_logbook_free; } // Count the number of dives to download. @@ -506,7 +506,7 @@ tecdiving_divecomputereu_device_foreach (dc_device_t *abstract, dc_dive_callback dc_buffer_t *buffer = dc_buffer_new(0); if (buffer == NULL) { status = DC_STATUS_NOMEMORY; - goto error_free; + goto error_logbook_free; } for (unsigned int i = 0; i < ndives; ++i) { @@ -515,7 +515,7 @@ tecdiving_divecomputereu_device_foreach (dc_device_t *abstract, dc_dive_callback // Read the dive. status = tecdiving_divecomputereu_readdive (abstract, &progress, i, buffer); if (status != DC_STATUS_SUCCESS) { - goto error_free; + goto error_buffer_free; } // Cache the pointer. @@ -526,7 +526,7 @@ tecdiving_divecomputereu_device_foreach (dc_device_t *abstract, dc_dive_callback if (memcmp (data, logbook + offset, SZ_SUMMARY) != 0) { ERROR (abstract->context, "Dive header doesn't match logbook entry."); status = DC_STATUS_DATAFORMAT; - goto error_free; + goto error_buffer_free; } if (callback && !callback (data, size, data, sizeof(device->fingerprint), userdata)) { @@ -534,8 +534,9 @@ tecdiving_divecomputereu_device_foreach (dc_device_t *abstract, dc_dive_callback } } -error_free: +error_buffer_free: dc_buffer_free (buffer); +error_logbook_free: free (logbook); error_exit: return status;