On Wed, Oct 07, 2015 at 03:48:48PM +0200, Vincent Stehlé wrote:
The read_trace_config() can dereference the line pointer after freeing it on its error path. Avoid that.
This was found by Coverity Scan.
Signed-off-by: Vincent Stehlé vincent.stehle@freescale.com Cc: Simon Glass sjg@chromium.org
Were you in the Coverity talk too? :) I saw this error as well today now. I was actually thinking along the lines of: diff --git a/tools/proftool.c b/tools/proftool.c index 9ce7a77..b3d3057 100644 --- a/tools/proftool.c +++ b/tools/proftool.c @@ -433,8 +433,9 @@ static int read_trace_config(FILE *fin) err = regcomp(&line->regex, tok, REG_NOSUB); if (err) { free(line); - return regex_report_error(&line->regex, err, "compile", + err = regex_report_error(&line->regex, err, "compile", tok); + return err; }
/* link this new one to the end of the list */