nfs_fchown_async: fix nullptr dereference

[deb_libnfs.git] / lib / libnfs.c

diff --git a/lib/libnfs.c b/lib/libnfs.c
index 6e7cd214a3fefa3d47244048c1fc0db2c19cc674..b2a53508b82ec85d1d6619b1bbe56becd15ca68b 100644 (file)
--- a/lib/libnfs.c
+++ b/lib/libnfs.c
@@ -2371,6 +2371,7 @@ int nfs_creat_async(struct nfs_context *nfs, const char *path, int mode, nfs_cb
        ptr = strrchr(new_path, '/');
        if (ptr == NULL) {
                rpc_set_error(nfs->rpc, "Invalid path %s", path);
+               free(new_path);
                return -1;
        }
        *ptr = 0;
@@ -2592,6 +2593,7 @@ int nfs_mknod_async(struct nfs_context *nfs, const char *path, int mode, int dev
        ptr = strrchr(cb_data->path, '/');
        if (ptr == NULL) {
                rpc_set_error(nfs->rpc, "Invalid path %s", path);
+               free_mknod_cb_data(cb_data);
                return -1;
        }
        *ptr = 0;
@@ -3431,10 +3433,10 @@ int nfs_fchown_async(struct nfs_context *nfs, struct nfsfh *nfsfh, int uid, int
        chown_data->uid = uid;
        chown_data->gid = gid;
 
-
        data = malloc(sizeof(struct nfs_cb_data));
        if (data == NULL) {
                rpc_set_error(nfs->rpc, "out of memory. failed to allocate memory for fchown data");
+               free(chown_data);
                return -1;
        }
        memset(data, 0, sizeof(struct nfs_cb_data));
@@ -3442,6 +3444,7 @@ int nfs_fchown_async(struct nfs_context *nfs, struct nfsfh *nfsfh, int uid, int
        data->cb            = cb;
        data->private_data  = private_data;
        data->continue_data = chown_data;
+       data->free_continue_data = free;
        data->fh.data.data_len = nfsfh->fh.data.data_len;
        data->fh.data.data_val = malloc(data->fh.data.data_len);
        if (data->fh.data.data_val == NULL) {
@@ -3451,7 +3454,6 @@ int nfs_fchown_async(struct nfs_context *nfs, struct nfsfh *nfsfh, int uid, int
        }
        memcpy(data->fh.data.data_val, nfsfh->fh.data.data_val, data->fh.data.data_len);
 
-
        if (nfs_chown_continue_internal(nfs, data) != 0) {
                free_nfs_cb_data(data);
                return -1;