search

dlbeer / dhara

NAND flash translation layer for low-memory systems
Other
408 stars 119 forks source link

`dhara_journal_enqueue` can fail with `DHARA_E_NONE` #32

Closed cbiffle closed 2 years ago

cbiffle commented 2 years ago

If dhara_journal_enqueue is called with a NULL data pointer, this logic can fall through to line 840 with my_err still set to DHARA_E_NONE:

        if (!(prepare_head(j, &my_err) ||
              (data && dhara_nand_prog(j->nand, j->head, data,
                           &my_err))))
            return push_meta(j, meta, err);

        if (recover_from(j, my_err, err) < 0)
            return -1;

This causes it to pass DHARA_E_NONE into recover_from, which will treat it as a failure due to this test. The net effect is that dhara_journal_enqueue will return -1, but the *err value will be DHARA_E_NONE.

cbiffle commented 2 years ago

...actually, I think I misunderstood the logic in that nested ||/&& expression, and am incorrect.