diff options
author | Florin Malita <fmalita@gmail.com> | 2007-10-15 11:59:18 -0400 |
---|---|---|
committer | Mauro Carvalho Chehab <mchehab@infradead.org> | 2007-10-22 10:01:49 -0400 |
commit | e7222ca9b4e6c6cdabedd8d33da59263ace85a02 (patch) | |
tree | 4be415d5c0c9d770543c464ff2b2540542a7cba5 /drivers | |
parent | 2f7362ef9bc9c41436c7f44212a2dcf12dddffbf (diff) |
V4L/DVB (6350): V4L: possible leak in em28xx_init_isoc
Coverity (CID 1929) spotted the following: if a transfer buffer
allocation fails, the last allocated urb is leaked (it hasn't been
stored in dev->urb[] yet so em28xx_uninit_isoc misses it). The patch
also includes a small typo fix.
Signed-off-by: Florin Malita <fmalita@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/media/video/em28xx/em28xx-core.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c index d3282ec62c5b..d56484f20467 100644 --- a/drivers/media/video/em28xx/em28xx-core.c +++ b/drivers/media/video/em28xx/em28xx-core.c | |||
@@ -648,7 +648,7 @@ void em28xx_uninit_isoc(struct em28xx *dev) | |||
648 | */ | 648 | */ |
649 | int em28xx_init_isoc(struct em28xx *dev) | 649 | int em28xx_init_isoc(struct em28xx *dev) |
650 | { | 650 | { |
651 | /* change interface to 3 which allowes the biggest packet sizes */ | 651 | /* change interface to 3 which allows the biggest packet sizes */ |
652 | int i, errCode; | 652 | int i, errCode; |
653 | const int sb_size = EM28XX_NUM_PACKETS * dev->max_pkt_size; | 653 | const int sb_size = EM28XX_NUM_PACKETS * dev->max_pkt_size; |
654 | 654 | ||
@@ -673,6 +673,7 @@ int em28xx_init_isoc(struct em28xx *dev) | |||
673 | ("unable to allocate %i bytes for transfer buffer %i\n", | 673 | ("unable to allocate %i bytes for transfer buffer %i\n", |
674 | sb_size, i); | 674 | sb_size, i); |
675 | em28xx_uninit_isoc(dev); | 675 | em28xx_uninit_isoc(dev); |
676 | usb_free_urb(urb); | ||
676 | return -ENOMEM; | 677 | return -ENOMEM; |
677 | } | 678 | } |
678 | memset(dev->transfer_buffer[i], 0, sb_size); | 679 | memset(dev->transfer_buffer[i], 0, sb_size); |