From dan@kulesh.obluda.cz  Tue Jul 12 21:18:55 2005
Return-Path: <dan@kulesh.obluda.cz>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 3D77016A41C
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 12 Jul 2005 21:18:55 +0000 (GMT)
	(envelope-from dan@kulesh.obluda.cz)
Received: from kulesh.obluda.cz (kulesh.obluda.cz [193.179.22.243])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 1934B43D48
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 12 Jul 2005 21:18:53 +0000 (GMT)
	(envelope-from dan@kulesh.obluda.cz)
Received: from kulesh.obluda.cz (localhost.eunet.cz [127.0.0.1])
	by kulesh.obluda.cz (8.13.3/8.13.3) with ESMTP id j6CLInHk017403
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 12 Jul 2005 23:18:50 +0200 (CEST)
	(envelope-from dan@kulesh.obluda.cz)
Received: (from root@localhost)
	by kulesh.obluda.cz (8.13.3/8.13.1/Submit) id j6CLInkQ017402;
	Tue, 12 Jul 2005 23:18:49 +0200 (CEST)
	(envelope-from dan)
Message-Id: <200507122118.j6CLInkQ017402@kulesh.obluda.cz>
Date: Tue, 12 Jul 2005 23:18:49 +0200 (CEST)
From: Dan Lukes <dan@obluda.cz>
Reply-To: Dan Lukes <dan@obluda.cz>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: [ PATCH ] Improper malloc failure handling within cam_device_dup()
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         83352
>Category:       bin
>Synopsis:       [patch] Improper malloc failure handling within cam_device_dup()
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    delphij
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Jul 12 21:20:01 GMT 2005
>Closed-Date:    Sun Jul 17 17:30:26 GMT 2005
>Last-Modified:  Sun Jul 17 17:30:26 GMT 2005
>Originator:     Dan Lukes
>Release:        FreeBSD 5.4-STABLE i386
>Organization:
Obludarium
>Environment:
System: FreeBSD 5.4-STABLE #8: Sat Jul 9 16:31:08 CEST 2005 i386
lib/libcam/camlib.c,v 1.12 2004/07/29 15:35:45 scottl

>Description:
	Improper malloc failure handling within cam_device_dup() can cause
NULL dereference.

	BTW, free() can be called with NULL, so 'if(x) free(x)'
construct isn't necesarry.
	
>How-To-Repeat:
>Fix:

--- patch begins here ---
--- lib/libcam/camlib.c.ORIG	Sun Aug  8 21:03:38 2004
+++ lib/libcam/camlib.c	Tue Jul 12 23:01:41 2005
@@ -97,8 +97,7 @@
 void
 cam_freeccb(union ccb *ccb)
 {
-	if (ccb != NULL)
-		free(ccb);
+	free(ccb);
 }
 
 /*
@@ -709,7 +708,6 @@
 	cam_close_spec_device(dev);

-	if (dev != NULL)
-		free(dev);
+	free(dev);
 }
 
 void
@@ -757,6 +755,11 @@
 	}
 
 	newdev = malloc(sizeof(struct cam_device));
+	if (newdev == NULL) {
+		snprintf(cam_errbuf, CAM_ERRBUF_SIZE, 
+			 "%s: couldn't malloc CAM device structure", func_name);
+		return(NULL);
+	}
 
 	bcopy(device, newdev, sizeof(struct cam_device));
 
--- patch ends here ---
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->delphij 
Responsible-Changed-By: delphij 
Responsible-Changed-When: Wed Jul 13 05:00:23 GMT 2005 
Responsible-Changed-Why:  
Grab 

http://www.freebsd.org/cgi/query-pr.cgi?pr=83352 
State-Changed-From-To: open->patched 
State-Changed-By: delphij 
State-Changed-When: Wed Jul 13 10:40:53 GMT 2005 
State-Changed-Why:  
Patch applied against 7-CURRENT.  MT6/5 awaiting approval from re@ 

http://www.freebsd.org/cgi/query-pr.cgi?pr=83352 

From: Dan Lukes <dan@obluda.cz>
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: bin/83352: [ PATCH ] Improper malloc failure handling within
 cam_device_dup()
Date: Thu, 14 Jul 2005 02:48:47 +0200

 	I didn't see the 4.x version within your list. I won't start any flame 
 here, but the 4.x releases are only production-stable releases  avaiable 
 for now. 5.x still have glitches, especially on SMP hardware, so I don't 
 understand why version 7 has been created just now ...
 
 	Well, never mind. I just would like to ask you to MFC the patch to 
 RELENG_4 also.
 
 	Thank you
 				Sincerelly
 
 					Dan
 
 
 -- 
 Dan Lukes                                   SISAL MFF UK
State-Changed-From-To: patched->closed 
State-Changed-By: delphij 
State-Changed-When: Sun Jul 17 17:29:46 GMT 2005 
State-Changed-Why:  
MFC completed (RELENG_4 added to the list per your request). 

Thanks for your submission! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=83352 
>Unformatted:
