bhyve: Avoid passing a possible garbage pointer to free().

[jhb]

Summary

All of the error paths in pci_vtcon_sock_add free the sock pointer.
However, sock is not initialized until part way through the function.
An early error would pass stack garbage to free().

usr.sbin/bhyve/pci_virtio_console.c

 exit_cleanup(void)
 {
 
         if (dirfd != -1 && newfile != NULL)
                 if (unlinkat(dirfd, newfile, 0))
                         warn("unlinkat");
 }
 
+static inline off_t
+add_off_t(off_t a, off_t b)
+{
+        off_t result;
+
+#if __GNUC__ >= 5 || \
+    (defined(__has_builtin) && __has_builtin(__builtin_add_overflow))
+        if (__builtin_add_overflow(a, b, &result))
+                errx(1, "Corrupt patch");
+#else
+        if ((b > 0 && a > OFF_MAX - b) || (b < 0 && a < OFF_MIN - b))
+                errx(1, "Corrupt patch");
+        result = a + b;
+#endif
+        return result;
+}
+
 static off_t offtin(u_char *buf)
 {
         off_t y;
 
         y = buf[7] & 0x7F;
         y = y * 256; y += buf[6];
         y = y * 256; y += buf[5];
         y = y * 256; y += buf[4];
#endif
         /* Close patch file and re-open it via libbzip2 at the right places */
         if (fclose(f))
                 err(1, "fclose(%s)", argv[3]);
         offset = HEADER_SIZE;
         if (fseeko(cpf, offset, SEEK_SET))
                 err(1, "fseeko(%s, %jd)", argv[3], (intmax_t)offset);
         if ((cpfbz2 = BZ2_bzReadOpen(&cbz2err, cpf, 0, 0, NULL, 0)) == NULL)
                 errx(1, "BZ2_bzReadOpen, bz2err = %d", cbz2err);
-        offset += bzctrllen;
+        offset = add_off_t(offset, bzctrllen);
         if (fseeko(dpf, offset, SEEK_SET))
                 err(1, "fseeko(%s, %jd)", argv[3], (intmax_t)offset);
         if ((dpfbz2 = BZ2_bzReadOpen(&dbz2err, dpf, 0, 0, NULL, 0)) == NULL)
                 errx(1, "BZ2_bzReadOpen, bz2err = %d", dbz2err);
-        offset += bzdatalen;
+        offset = add_off_t(offset, bzdatalen);
         if (fseeko(epf, offset, SEEK_SET))
                 err(1, "fseeko(%s, %jd)", argv[3], (intmax_t)offset);
         if ((epfbz2 = BZ2_bzReadOpen(&ebz2err, epf, 0, 0, NULL, 0)) == NULL)
                 errx(1, "BZ2_bzReadOpen, bz2err = %d", ebz2err);
 
         if ((oldsize = lseek(oldfd, 0, SEEK_END)) == -1 ||
             oldsize > SSIZE_MAX ||
             (old = malloc(oldsize)) == NULL ||
while (newpos < newsize) {
                 }
 
                 /* Sanity-check */
                 if (ctrl[0] < 0 || ctrl[0] > INT_MAX ||
                     ctrl[1] < 0 || ctrl[1] > INT_MAX)
                         errx(1, "Corrupt patch");
 
                 /* Sanity-check */
-                if (newpos + ctrl[0] > newsize)
+                if (add_off_t(newpos, ctrl[0]) > newsize)
                         errx(1, "Corrupt patch");
 
                 /* Read diff string */
                 lenread = BZ2_bzRead(&dbz2err, dpfbz2, new + newpos, ctrl[0]);
                 if ((lenread < ctrl[0]) ||
                     ((dbz2err != BZ_OK) && (dbz2err != BZ_STREAM_END)))
                         errx(1, "Corrupt patch");
 
                 /* Add old data to diff string */
                 for (i = 0; i < ctrl[0]; i++)
-                        if ((oldpos + i >= 0) && (oldpos + i < oldsize))
+                        if (add_off_t(oldpos, i) < oldsize)
                                 new[newpos + i] += old[oldpos + i];
 
                 /* Adjust pointers */
-                newpos += ctrl[0];
-                oldpos += ctrl[0];
+                newpos = add_off_t(newpos, ctrl[0]);
+                oldpos = add_off_t(oldpos, ctrl[0]);
 
                 /* Sanity-check */
-                if (newpos + ctrl[1] > newsize)
+                if (add_off_t(newpos, ctrl[1]) > newsize)
                         errx(1, "Corrupt patch");
 
                 /* Read extra string */
                 lenread = BZ2_bzRead(&ebz2err, epfbz2, new + newpos, ctrl[1]);
                 if ((lenread < ctrl[1]) ||
                     ((ebz2err != BZ_OK) && (ebz2err != BZ_STREAM_END)))
                         errx(1, "Corrupt patch");
 
                 /* Adjust pointers */
-                newpos+=ctrl[1];
-                oldpos+=ctrl[2];
+                newpos = add_off_t(newpos, ctrl[1]);
+                oldpos = add_off_t(oldpos, ctrl[2]);
         }
 
         /* Clean up the bzip2 reads */
         BZ2_bzReadClose(&cbz2err, cpfbz2);
         BZ2_bzReadClose(&dbz2err, dpfbz2);
         BZ2_bzReadClose(&ebz2err, epfbz2);
         if (fclose(cpf) || fclose(dpf) || fclose(epf))
                 err(1, "fclose(%s)", argv[3]);