From 5836464f454f0bb4612c665d27061956d4c745af Mon Sep 17 00:00:00 2001 From: Garrett Wollman Date: Sat, 13 Aug 2011 18:34:47 -0400 Subject: [PATCH] libafs: don't crash if afs_write() is called with zero-length uio If AFS_UIO_RESID(auio) is zero in afs_write(), we could end up calling afsio_free(NULL). Guard the free. (In the alternative, perhaps we should just osi_Assert(totalLength > 0) instead?) Change-Id: Ic218f039e2034b679cb4817a543af2e8307f36f8 Found-by: clang static analyzer with the help of AFS_NONNULL Reviewed-on: http://gerrit.openafs.org/5259 Tested-by: BuildBot Reviewed-by: Derrick Brashear --- src/afs/VNOPS/afs_vnop_write.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/afs/VNOPS/afs_vnop_write.c b/src/afs/VNOPS/afs_vnop_write.c index 90e781151..0f6007b59 100644 --- a/src/afs/VNOPS/afs_vnop_write.c +++ b/src/afs/VNOPS/afs_vnop_write.c @@ -398,7 +398,8 @@ afs_write(struct vcache *avc, struct uio *auio, int aio, avc->vc_error = error; if (!noLock) ReleaseWriteLock(&avc->lock); - afsio_free(tuiop); + if (tuiop) + afsio_free(tuiop); #ifndef AFS_VM_RDWR_ENV /* -- 2.39.5