Raspberries/mraa
Private
Public Access
2
0
Fork 0
Code Activity

iio.c: fix memory leak and out of bound array access issue

Browse Source 
Fix memory leak in mraa_iio_update_channels() and mraa_iio_get_channel_data().
In mraa_iio_update_channels(), we add checking for out of bound array access.

Signed-off-by: Lay, Kuan Loon <kuan.loon.lay@intel.com>
Signed-off-by: Brendan Le Foll <brendan.le.foll@intel.com>
This commit is contained in:
Lay, Kuan Loon
2015-12-17 14:53:44 +08:00
committed by Brendan Le Foll
parent 4ffb094063
commit d5233adbf9
1 changed files with 25 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
src/iio/iio.c Normal file → Executable file
View File

@@ -154,6 +154,7 @@ mraa_iio_get_channel_data(mraa_iio_context dev)
if (fd > 0) { if (fd > 0) {
if (read(fd, readbuf, 2 * sizeof(char)) != 2) { if (read(fd, readbuf, 2 * sizeof(char)) != 2) {
syslog(LOG_ERR, "iio: Failed to read a sensible value from sysfs"); syslog(LOG_ERR, "iio: Failed to read a sensible value from sysfs");
free(str);
return -1; return -1;
} }
chan->enabled = (int) strtol(readbuf, NULL, 10); chan->enabled = (int) strtol(readbuf, NULL, 10);
@@ -577,29 +578,32 @@ mraa_iio_update_channels(mraa_iio_context dev)
break; break;
} }
chan_num = ((int) strtol(readbuf, NULL, 10)); chan_num = ((int) strtol(readbuf, NULL, 10));
chan = &dev->channels[chan_num]; if (chan_num >= 0 && chan_num < dev->chan_num) {
chan->index = chan_num; chan = &dev->channels[chan_num];
close(fd); chan->index = chan_num;
buf[(strlen(buf) - 5)] = '\0';
char* str = strdup(buf);
// grab the enable flag of channel
snprintf(buf, MAX_SIZE, "%sen", str);
fd = open(buf, O_RDONLY);
if (fd > 0) {
if (read(fd, readbuf, 2 * sizeof(char)) != 2) {
syslog(LOG_ERR, "iio: Failed to read a sensible value from sysfs");
return -1;
}
chan->enabled = (int) strtol(readbuf, NULL, 10);
// only calculate enable buffer size for trigger buffer extract data
if (chan->enabled) {
dev->datasize += chan->bytes;
}
close(fd); close(fd);
buf[(strlen(buf) - 5)] = '\0';
char* str = strdup(buf);
// grab the enable flag of channel
snprintf(buf, MAX_SIZE, "%sen", str);
fd = open(buf, O_RDONLY);
if (fd > 0) {
if (read(fd, readbuf, 2 * sizeof(char)) != 2) {
syslog(LOG_ERR, "iio: Failed to read a sensible value from sysfs");
free(str);
return -1;
}
chan->enabled = (int) strtol(readbuf, NULL, 10);
// only calculate enable buffer size for trigger buffer extract data
if (chan->enabled) {
dev->datasize += chan->bytes;
}
close(fd);
}
// clean up str var
free(str);
} }
// clean up str var
free(str);
} }
} }
} }