From d19b266ed42db5bada1ffcec1e36d7f9fa9fcec8 Mon Sep 17 00:00:00 2001 From: Gary Date: Wed, 5 Dec 2018 11:42:18 -0800 Subject: [PATCH] [LibOS] Fix memory leak in __map_elf_object() Pointer l can point to a newly allocated object (via new_elf_object()). Ensure l is freed on error (on call_lose code path). --- LibOS/shim/src/elf/shim_rtld.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/LibOS/shim/src/elf/shim_rtld.c b/LibOS/shim/src/elf/shim_rtld.c index a0551871..a933302b 100644 --- a/LibOS/shim/src/elf/shim_rtld.c +++ b/LibOS/shim/src/elf/shim_rtld.c @@ -366,11 +366,14 @@ __map_elf_object (struct shim_handle * file, if (file && (!read || !mmap || !seek)) return NULL; - struct link_map * l = remap ? : + struct link_map * l = remap ? remap : new_elf_object(file ? (!qstrempty(&file->path) ? qstrgetstr(&file->path) : qstrgetstr(&file->uri)) : "", type); + if (!l) + return NULL; + const char * errstring __attribute__((unused)) = NULL; int errval = 0; int ret; @@ -378,9 +381,7 @@ __map_elf_object (struct shim_handle * file, if (type != OBJECT_INTERNAL && !file) { errstring = "shared object has to be backed by file"; errval = -EINVAL; -call_lose: - debug("loading %s: %s\n", l->l_name, errstring); - return NULL; + goto call_lose; } /* Scan the program header table, collecting its load commands. */ @@ -728,6 +729,14 @@ postmap: setup_elf_hash(l); return l; + +call_lose: + debug("loading %s: %s\n", l->l_name, errstring); + if (l != remap) { + /* l was allocated via new_elf_object() */ + free(l); + } + return NULL; } static inline