svn commit: r316047 - stable/10/lib/libcam

[Ngie Cooper]

Author: ngie
Date: Mon Mar 27 18:29:30 2017
New Revision: 316047
URL: https://svnweb.freebsd.org/changeset/base/316047

Log:
  MFC r315639:
  
  libcam: NULL out freed `ccb.cdm.matches` and `ccb.cdm.patterns` pointers
  
  This is being done to avoid potential double frees with the values.

Modified:
  stable/10/lib/libcam/camlib.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/lib/libcam/camlib.c
==============================================================================
--- stable/10/lib/libcam/camlib.c	Mon Mar 27 18:28:17 2017	(r316046)
+++ stable/10/lib/libcam/camlib.c	Mon Mar 27 18:29:30 2017	(r316047)
@@ -308,6 +308,7 @@ cam_open_btl(path_id_t path_id, target_i
 		snprintf(cam_errbuf, CAM_ERRBUF_SIZE,
 			 "%s: couldn't malloc pattern buffer", func_name);
 		free(ccb.cdm.matches);
+		ccb.cdm.matches = NULL;
 		close(fd);
 		return(NULL);
 	}
@@ -371,7 +372,9 @@ cam_open_btl(path_id_t path_id, target_i
 		periph_result = &ccb.cdm.matches[0].result.periph_result;
 		pass_unit = periph_result->unit_number;
 		free(ccb.cdm.matches);
+		ccb.cdm.matches = NULL;
 		free(ccb.cdm.patterns);
+		ccb.cdm.patterns = NULL;
 		close(fd);
 		sprintf(dev_path, "/dev/pass%d", pass_unit);
 		return(cam_real_open_device(dev_path, flags, device, NULL,
@@ -388,7 +391,9 @@ cam_open_btl(path_id_t path_id, target_i
 
 btl_bailout:
 	free(ccb.cdm.matches);
+	ccb.cdm.matches = NULL;
 	free(ccb.cdm.patterns);
+	ccb.cdm.patterns = NULL;
 	close(fd);
 	return(NULL);
 }