mika/switch-tools
1
0
Fork 0
mirror of https://github.com/switchbrew/switch-tools.git synced 2025-06-22 05:52:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

build_romfs: fix use-after-free in romfs building

Browse Source
This commit is contained in:
Michael Scire 2021-07-15 20:20:26 -07:00 committed by fincs
parent f6561ef910
commit 6f1d635208
1 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
src/romfs.c
View File

@ -410,9 +410,7 @@ size_t build_romfs_into_file(filepath_t *in_dirpath, FILE *f_out, off_t base_off
cur_entry->name_size = name_size; cur_entry->name_size = name_size;
memcpy(cur_entry->name, cur_dir->cur_path.char_path + 1, name_size); memcpy(cur_entry->name, cur_dir->cur_path.char_path + 1, name_size);
romfs_dirent_ctx_t *temp = cur_dir;
cur_dir = cur_dir->next; cur_dir = cur_dir->next;
free(temp);
} }
header.header_size = le_dword(sizeof(header)); header.header_size = le_dword(sizeof(header));
@ -474,11 +472,27 @@ size_t build_romfs_into_file(filepath_t *in_dirpath, FILE *f_out, off_t base_off
os_fclose(f_in); os_fclose(f_in);
cur_file = cur_file->next;
}
free(buffer);
/* Free all files. */
cur_file = romfs_ctx.files;
while (cur_file != NULL) {
romfs_fent_ctx_t *temp = cur_file; romfs_fent_ctx_t *temp = cur_file;
cur_file = cur_file->next; cur_file = cur_file->next;
free(temp); free(temp);
} }
free(buffer); romfs_ctx.files = NULL;
/* Free all directories. */
cur_dir = root_ctx;
while (cur_dir != NULL) {
romfs_dirent_ctx_t *temp = cur_dir;
cur_dir = cur_dir->next;
free(temp);
}
root_ctx = NULL;
fseeko64(f_out, base_offset + dir_hash_table_ofs, SEEK_SET); fseeko64(f_out, base_offset + dir_hash_table_ofs, SEEK_SET);
if (fwrite(dir_hash_table, 1, romfs_ctx.dir_hash_table_size, f_out) != romfs_ctx.dir_hash_table_size) { if (fwrite(dir_hash_table, 1, romfs_ctx.dir_hash_table_size, f_out) != romfs_ctx.dir_hash_table_size) {