svn commit: r324830 - stable/11/sys/contrib/libnv

[Mariusz Zaborski]

Author: oshogbo
Date: Sat Oct 21 19:33:31 2017
New Revision: 324830
URL: https://svnweb.freebsd.org/changeset/base/324830

Log:
  MFC r323854:
  Because nvp wasn't initialized on every loop iteration once we jumped
  to 'fail' on error it was treated as success, because nvp!=NULL. Fix this
  by not handling success under 'fail' label and by using separate variable
  for parent nvpair.
  
  If we succeeded to allocate nvlist, but failed to allocated nvpair we
  would leak nvls[ii] on return. Destroy it when we cannot allocate nvpair,
  before we goto fail.
  
  Submitted by:	pjd@ and oshogbo@ (minor changes)
  Found by:	scan-build
  Sponsored by:	Wheel Systems

Modified:
  stable/11/sys/contrib/libnv/nvpair.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/contrib/libnv/nvpair.c
==============================================================================
--- stable/11/sys/contrib/libnv/nvpair.c	Sat Oct 21 19:31:59 2017	(r324829)
+++ stable/11/sys/contrib/libnv/nvpair.c	Sat Oct 21 19:33:31 2017	(r324830)
@@ -1407,10 +1407,9 @@ nvpair_create_nvlist_array(const char *name, const nvl
 {
 	unsigned int ii;
 	nvlist_t **nvls;
-	nvpair_t *nvp;
+	nvpair_t *parent;
 	int flags;
 
-	nvp = NULL;
 	nvls = NULL;
 	ii = 0;
 
@@ -1434,33 +1433,40 @@ nvpair_create_nvlist_array(const char *name, const nvl
 			goto fail;
 
 		if (ii > 0) {
+			nvpair_t *nvp;
+
 			nvp = nvpair_allocv(" ", NV_TYPE_NVLIST,
 			    (uint64_t)(uintptr_t)nvls[ii], 0, 0);
-			if (nvp == NULL)
+			if (nvp == NULL) {
+				ERRNO_SAVE();
+				nvlist_destroy(nvls[ii]);
+				ERRNO_RESTORE();
 				goto fail;
+			}
 			nvlist_set_array_next(nvls[ii - 1], nvp);
 		}
 	}
 	flags = nvlist_flags(nvls[nitems - 1]) | NV_FLAG_IN_ARRAY;
 	nvlist_set_flags(nvls[nitems - 1], flags);
 
-	nvp = nvpair_allocv(name, NV_TYPE_NVLIST_ARRAY,
+	parent = nvpair_allocv(name, NV_TYPE_NVLIST_ARRAY,
 	    (uint64_t)(uintptr_t)nvls, 0, nitems);
+	if (parent == NULL)
+		goto fail;
 
-fail:
-	if (nvp == NULL) {
-		ERRNO_SAVE();
-		for (; ii > 0; ii--)
-			nvlist_destroy(nvls[ii - 1]);
+	for (ii = 0; ii < nitems; ii++)
+		nvlist_set_parent(nvls[ii], parent);
 
-		nv_free(nvls);
-		ERRNO_RESTORE();
-	} else {
-		for (ii = 0; ii < nitems; ii++)
-			nvlist_set_parent(nvls[ii], nvp);
-	}
+	return (parent);
 
-	return (nvp);
+fail:
+	ERRNO_SAVE();
+	for (; ii > 0; ii--)
+		nvlist_destroy(nvls[ii - 1]);
+	nv_free(nvls);
+	ERRNO_RESTORE();
+
+	return (NULL);
 }
 
 #ifndef _KERNEL