Commit 9b7f79a
src: fix double free reported by coverity
Fix double free reported by coverity. ToBufferEndian()
in node_i18n.cc was the only caller of Buffer::New() passing
in a MaybeStackBuffer. Coverity reported a double free
because there were paths in which the src buffer would
be deleted by both the destruction of the MaybeStackBuffer and
by the Buffer which was done even in failure cases for
Buffer::New().
Signed-off-by: Michael Dawson <midawson@redhat.com>
PR-URL: #51046
Reviewed-By: James M Snell <jasnell@gmail.com>1 parent 7f95926 commit 9b7f79a
1 file changed
Lines changed: 5 additions & 8 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -192,16 +192,13 @@ static v8::MaybeLocal<v8::Object> New(Environment* env, | |||
| 192 | 192 | char* src = reinterpret_cast<char*>(buf->out()); | |
| 193 | 193 | const size_t len_in_bytes = buf->length() * sizeof(buf->out()[0]); | |
| 194 | 194 | ||
| 195 | - if (buf->IsAllocated()) | ||
| 195 | + if (buf->IsAllocated()) { | ||
| 196 | 196 | ret = New(env, src, len_in_bytes); | |
| 197 | - else if (!buf->IsInvalidated()) | ||
| 198 | - ret = Copy(env, src, len_in_bytes); | ||
| 199 | - | ||
| 200 | - if (ret.IsEmpty()) | ||
| 201 | - return ret; | ||
| 202 | - | ||
| 203 | - if (buf->IsAllocated()) | ||
| 197 | + // new always takes ownership of src | ||
| 204 | 198 | buf->Release(); | |
| 199 | + } else if (!buf->IsInvalidated()) { | ||
| 200 | + ret = Copy(env, src, len_in_bytes); | ||
| 201 | + } | ||
| 205 | 202 | ||
| 206 | 203 | return ret; | |
| 207 | 204 | } | |
0 commit comments