diff mbox

V4L/DVB (12098): dereference of state->internal in fe_stv0900_error stv0900_init_internal()

Message ID 4A997415.7010407@gmail.com (mailing list archive)
State Accepted
Headers show

Commit Message

Roel Kluin Aug. 29, 2009, 6:31 p.m. UTC 
state->internal allocation may fail as well as the allocation of
stv0900_first_inode or new_node->next_inode in append_internal().

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---
Is this the right thing to do if temp_int == NULL?

--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/media/dvb/frontends/stv0900_core.c b/drivers/media/dvb/frontends/stv0900_core.c
index 1da045f..b0aaf90 100644
--- a/drivers/media/dvb/frontends/stv0900_core.c
+++ b/drivers/media/dvb/frontends/stv0900_core.c
@@ -1407,7 +1407,14 @@  static enum fe_stv0900_error stv0900_init_internal(struct dvb_frontend *fe,
 		return STV0900_NO_ERROR;
 	} else {
 		state->internal = kmalloc(sizeof(struct stv0900_internal), GFP_KERNEL);
+		if (state->internal == NULL)
+			return STV0900_INVALID_HANDLE;
 		temp_int = append_internal(state->internal);
+		if (temp_int == NULL) {
+			kfree(state->internal);
+			state->internal == NULL;
+			return STV0900_INVALID_HANDLE;
+		}
 		state->internal->dmds_used = 1;
 		state->internal->i2c_adap = state->i2c_adap;
 		state->internal->i2c_addr = state->config->demod_address;