From 462c424500a592723887b861f857650523bab359 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Fri, 12 Feb 2021 21:43:00 -0500
Subject: [PATCH] debugfs: fix memory allocation failures when parsing
 journal_write arguments

Fix double-free issues when parsing an invalid journal_write command,
such as: "journal_write -b 12 -b BAD -b 42".

Conflict:return ENOMEM

---
 debugfs/do_journal.c |  8 ++++++--
 debugfs/util.c       | 15 +++++++--------
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/debugfs/do_journal.c b/debugfs/do_journal.c
index 15ef682..5091a53 100644
--- a/debugfs/do_journal.c
+++ b/debugfs/do_journal.c
@@ -554,15 +554,19 @@ void do_journal_write(int argc, char *argv[], int sci_idx EXT2FS_ATTR((unused)),
 		switch (opt) {
 		case 'b':
 			err = read_list(optarg, &blist, &bn);
-			if (err)
+			if (err) {
 				com_err(argv[0], err,
 					"while reading block list");
+				goto out;
+			}
 			break;
 		case 'r':
 			err = read_list(optarg, &rlist, &rn);
-			if (err)
+			if (err) {
 				com_err(argv[0], err,
 					"while reading revoke list");
+				goto out;
+			}
 			break;
 		case 'c':
 			flags |= JOURNAL_WRITE_NO_COMMIT;
diff --git a/debugfs/util.c b/debugfs/util.c
index 091f6f6..5e84912 100644
--- a/debugfs/util.c
+++ b/debugfs/util.c
@@ -521,7 +521,7 @@ errcode_t read_list(char *str, blk64_t **list, size_t *len)
 	blk64_t *lst = *list;
 	size_t ln = *len;
 	char *tok, *p = str;
-	errcode_t retval;
+	errcode_t retval = 0;
 
 	while ((tok = strtok(p, ","))) {
 		blk64_t *l;
@@ -538,15 +538,17 @@ errcode_t read_list(char *str, blk64_t **list, size_t *len)
 				return errno;
 		} else if (*e != 0) {
 			retval = EINVAL;
-			goto err;
+			break;
 		}
 		if (y < x) {
 			retval = EINVAL;
-			goto err;
+			break;
 		}
 		l = realloc(lst, sizeof(blk64_t) * (ln + y - x + 1));
-		if (l == NULL)
-			return ENOMEM;
+		if (l == NULL) {
+			retval = ENOMEM;
+			break;
+		}
 		lst = l;
 		for (; x <= y; x++)
 			lst[ln++] = x;
@@ -555,8 +557,5 @@ errcode_t read_list(char *str, blk64_t **list, size_t *len)
 
 	*list = lst;
 	*len = ln;
-	return 0;
-err:
-	free(lst);
 	return retval;
 }
-- 
1.8.3.1

