• Julia Lawall's avatar
    HID: picolcd: Eliminate use after free · aeacb6fd
    Julia Lawall authored
    The skip label frees resp, which has not been allocated at the point of
    this goto and then does a break, based on the fact that err is non-zero.
    This is replaced by a break directly.
    
    A simplified version of the semantic match that finds this problem is as
    follows: (http://coccinelle.lip6.fr/)
    
    // <smpl>
    @free@
    expression E;
    position p;
    @@
    kfree@p(E)
    
    @@
    expression free.E, subE<=free.E, E1;
    position free.p;
    @@
    
      kfree@p(E)
      ...
    (
      subE = E1
    |
    * E
    )
    // </smpl>
    Signed-off-by: default avatarJulia Lawall <julia@diku.dk>
    Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
    aeacb6fd
hid-picolcd.c 73.9 KB