Fix freeing wrong address

We increment the pointer for the firmware buffer as we read it, so we
can't free that value. This patch saves the original address so it may
be freed later.

Link: https://github.com/linux-nvme/nvme-cli/issues/304
Fixes: 7151acc
Signed-off-by: Keith Busch <keith.busch@intel.com>

diff --git a/nvme.c b/nvme.c
index 8e97cfab1626046b3afe039f08cdc42dcd04aa2f..7939b1624b093f2a79d0126b6c115b0314f4a5b6 100644 (file)
--- a/nvme.c
+++ b/nvme.c
@@ -1869,7 +1869,7 @@ static int fw_download(int argc, char **argv, struct command *cmd, struct plugin
        int err, fd, fw_fd = -1;
        unsigned int fw_size;
        struct stat sb;
-       void *fw_buf;
+       void *fw_buf, *buf;
 
        struct config {
                char  *fw;
@@ -1919,6 +1919,8 @@ static int fw_download(int argc, char **argv, struct command *cmd, struct plugin
                err = ENOMEM;
                goto close_fw_fd;
        }
+
+       buf = fw_buf;
        if (cfg.xfer == 0 || cfg.xfer % 4096)
                cfg.xfer = 4096;
        if (read(fw_fd, fw_buf, fw_size) != ((ssize_t)(fw_size))) {
@@ -1946,7 +1948,7 @@ static int fw_download(int argc, char **argv, struct command *cmd, struct plugin
                printf("Firmware download success\n");
 
  free:
-       free(fw_buf);
+       free(buf);
  close_fw_fd:
        close(fw_fd);
  close_fd: