rsa: Fix missing memory leak on error in fdt_add_bignum()

Thsi function can fail without freeing all its memory. Fix it. Reported-by: Coverity (CID: 131217) Signed-off-by: Simon Glass <sjg@chromium.org>

rsa: Fix missing memory leak on error in fdt_add_bignum()
Thsi function can fail without freeing all its memory. Fix it. Reported-by: Coverity (CID: 131217) Signed-off-by: Simon Glass <sjg@chromium.org>
Simon Glass · Tom Rini
1 parent dd0ee9ea85
Showing 1 changed file with 10 additions and 3 deletions Side-by-side Diff
lib/rsa/rsa-sign.c
@@ -635,6 +635,15 @@
 	big2 = BN_new();
 	big32 = BN_new();
 	big2_32 = BN_new();
+
+	/*
+	 * Note: This code assumes that all of the above succeed, or all fail.
+	 * In practice memory allocations generally do not fail (unless the
+	 * process is killed), so it does not seem worth handling each of these
+	 * as a separate case. Technicaly this could leak memory on failure,
+	 * but a) it won't happen in practice, and b) it doesn't matter as we
+	 * will immediately exit with a failure code.
+	 */
 	if (!tmp || !big2 || !big32 || !big2_32) {
 		fprintf(stderr, "Out of memory (bignum)\n");
 		return -ENOMEM;
  
@@ -667,15 +676,13 @@
 	 * might fail several times
 	 */
 	ret = fdt_setprop(blob, noffset, prop_name, buf, size);
-	if (ret)
-		return -FDT_ERR_NOSPACE;
 	free(buf);
 	BN_free(tmp);
 	BN_free(big2);
 	BN_free(big32);
 	BN_free(big2_32);
  
-	return ret;
+	return ret ? -FDT_ERR_NOSPACE : 0;
 }
  
 int rsa_add_verify_data(struct image_sign_info *info, void *keydest)
...	...	@@ -635,6 +635,15 @@
635	635	big2 = BN_new();
636	636	big32 = BN_new();
637	637	big2_32 = BN_new();
	638	+
	639	+ /*
	640	+ * Note: This code assumes that all of the above succeed, or all fail.
	641	+ * In practice memory allocations generally do not fail (unless the
	642	+ * process is killed), so it does not seem worth handling each of these
	643	+ * as a separate case. Technicaly this could leak memory on failure,
	644	+ * but a) it won't happen in practice, and b) it doesn't matter as we
	645	+ * will immediately exit with a failure code.
	646	+ */
638	647	if (!tmp \|\| !big2 \|\| !big32 \|\| !big2_32) {
639	648	fprintf(stderr, "Out of memory (bignum)\n");
640	649	return -ENOMEM;
641	650
...	...	@@ -667,15 +676,13 @@
667	676	* might fail several times
668	677	*/
669	678	ret = fdt_setprop(blob, noffset, prop_name, buf, size);
670		- if (ret)
671		- return -FDT_ERR_NOSPACE;
672	679	free(buf);
673	680	BN_free(tmp);
674	681	BN_free(big2);
675	682	BN_free(big32);
676	683	BN_free(big2_32);
677	684
678		- return ret;
	685	+ return ret ? -FDT_ERR_NOSPACE : 0;
679	686	}
680	687
681	688	int rsa_add_verify_data(struct image_sign_info info, void keydest)