From 58644a0e0f9c64dcf26b7c3de7d0dd197b1f8cbc Mon Sep 17 00:00:00 2001 From: Furquan Shaikh Date: Fri, 5 Aug 2016 08:27:18 -0700 Subject: cbfstool/cbfs_image: Check for return value of buffer_create Free any buffers if required. Change-Id: Iccd435dba51275d875a5fdb5649cdcd0541fd84c Signed-off-by: Furquan Shaikh Found-by: Coverity Scan # 1361254 Reviewed-on: https://review.coreboot.org/16073 Reviewed-by: Paul Menzel Tested-by: build bot (Jenkins) Reviewed-by: Aaron Durbin --- util/cbfstool/cbfs_image.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'util') diff --git a/util/cbfstool/cbfs_image.c b/util/cbfstool/cbfs_image.c index 1efe7d152b..950f8ed0d5 100644 --- a/util/cbfstool/cbfs_image.c +++ b/util/cbfstool/cbfs_image.c @@ -847,7 +847,8 @@ static int cbfs_payload_decompress(struct cbfs_payload_segment *segments, for (int i = 0; i < num_seg; i++) new_buff_sz += segments[i].mem_len; - buffer_create(&new_buffer, new_buff_sz, "decompressed_buff"); + if (buffer_create(&new_buffer, new_buff_sz, "decompressed_buff")) + return -1; in_ptr = buffer_get(buff) + new_offset; out_ptr = buffer_get(&new_buffer) + new_offset; @@ -878,7 +879,10 @@ static int cbfs_payload_decompress(struct cbfs_payload_segment *segments, continue; } - buffer_create(&tbuff, segments[i].mem_len, "segment"); + if (buffer_create(&tbuff, segments[i].mem_len, "segment")) { + buffer_delete(&new_buffer); + return -1; + } if (decompress(in_ptr, segments[i].len, buffer_get(&tbuff), (int) buffer_size(&tbuff), -- cgit v1.2.3