From b85a0ab12280192fb864339543a942dbed90577c Mon Sep 17 00:00:00 2001 From: Matthew Daley Date: Mon, 12 Nov 2012 09:34:57 +0100 Subject: [PATCH] tmem: Prevent NULL dereference on error case If the client / pool IDs given to tmemc_save_get_next_page are invalid, the calculation of pagesize will dereference NULL. Fix this by moving the calculation below the appropriate NULL check. Signed-off-by: Matthew Daley Committed-by: Jan Beulich --- xen/common/tmem.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/xen/common/tmem.c b/xen/common/tmem.c index 128053731d..44e27721a2 100644 --- a/xen/common/tmem.c +++ b/xen/common/tmem.c @@ -2436,10 +2436,12 @@ static NOINLINE int tmemc_save_get_next_page(int cli_id, uint32_t pool_id, OID oid; int ret = 0; struct tmem_handle h; - unsigned int pagesize = 1 << (pool->pageshift+12); + unsigned int pagesize; if ( pool == NULL || is_ephemeral(pool) ) return -1; + + pagesize = 1 << (pool->pageshift + 12); if ( bufsize < pagesize + sizeof(struct tmem_handle) ) return -ENOMEM; -- 2.30.2