VBoot Reference: Fix many memory leaks.

src/platform/vboot_reference/utils/firmware_image.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Functions for generating and manipulating a verified boot firmware image.
  */
 
 #include "firmware_image.h"
 
 #include <fcntl.h>
@@ skipping 376 matching lines @@
                          algorithm))
     return VERIFY_FIRMWARE_SIGNATURE_FAILED;
   return 0;
 }
 
 int VerifyFirmware(const uint8_t* root_key_blob,
                    const uint8_t* firmware_blob,
                    const int dev_mode) {
   int error_code;
   int algorithm;  /* Signing key algorithm. */
-  RSAPublicKey* firmware_sign_key;
+  RSAPublicKey* firmware_sign_key = NULL;
   int firmware_sign_key_len, signature_len, header_len, firmware_len;
-  const uint8_t* header_ptr;  /* Pointer to header. */
-  const uint8_t* firmware_sign_key_ptr;  /* Pointer to signing key. */
-  const uint8_t* preamble_ptr;  /* Pointer to preamble block. */
-  const uint8_t* firmware_ptr;  /* Pointer to firmware signature/data. */
+  const uint8_t* header_ptr = NULL;  /* Pointer to header. */
+  const uint8_t* firmware_sign_key_ptr = NULL;  /* Pointer to signing key. */
+  const uint8_t* preamble_ptr = NULL;  /* Pointer to preamble block. */
+  const uint8_t* firmware_ptr = NULL;  /* Pointer to firmware signature/data. */
 
   /* Note: All the offset calculations are based on struct FirmwareImage which
    * is defined in include/firmware_image.h. */
 
   /* Compare magic bytes. */
   if (SafeMemcmp(firmware_blob, FIRMWARE_MAGIC, FIRMWARE_MAGIC_SIZE))
     return VERIFY_FIRMWARE_WRONG_MAGIC;
   header_ptr = firmware_blob + FIRMWARE_MAGIC_SIZE;
 
   /* Only continue if header verification succeeds. */
   if ((error_code = VerifyFirmwareHeader(root_key_blob, header_ptr, dev_mode,
                                          &algorithm, &header_len)))
     return error_code;  /* AKA jump to revovery. */
 
   /* Parse signing key into RSAPublicKey structure since it is required multiple
    * times. */
   firmware_sign_key_len = RSAProcessedKeySize(algorithm);
   firmware_sign_key_ptr = header_ptr + (FIELD_LEN(header_len) +
                                FIELD_LEN(firmware_sign_algorithm));
   firmware_sign_key = RSAPublicKeyFromBuf(firmware_sign_key_ptr,
                                           firmware_sign_key_len);
   signature_len = siglen_map[algorithm];
 
   /* Only continue if preamble verification succeeds. */
   preamble_ptr = (header_ptr + header_len +
                   FIELD_LEN(firmware_key_signature));
   if ((error_code = VerifyFirmwarePreamble(firmware_sign_key, preamble_ptr,
                                            algorithm,
-                                           &firmware_len)))
+                                           &firmware_len))) {
+    RSAPublicKeyFree(firmware_sign_key);
     return error_code;  /* AKA jump to recovery. */
-
+  }
   /* Only continue if firmware data verification succeeds. */
   firmware_ptr = (preamble_ptr +
                   FIELD_LEN(firmware_version) +
                   FIELD_LEN(firmware_len) +
                   FIELD_LEN(preamble) +
                   signature_len);
 
   if ((error_code = VerifyFirmwareData(firmware_sign_key, firmware_ptr,
                                        firmware_len,
-                                       algorithm)))
+                                       algorithm))) {
+    RSAPublicKeyFree(firmware_sign_key);
     return error_code;  /* AKA jump to recovery. */
+  }
 
+  RSAPublicKeyFree(firmware_sign_key);
   return 0;  /* Success! */
 }
 
 int VerifyFirmwareImage(const RSAPublicKey* root_key,
                         const FirmwareImage* image,
                         const int dev_mode) {
-  RSAPublicKey* firmware_sign_key;
+  RSAPublicKey* firmware_sign_key = NULL;
   uint8_t* header_digest = NULL;
   uint8_t* preamble_digest = NULL;
   uint8_t* firmware_digest = NULL;
   int firmware_sign_key_size;
   int signature_size;
   int error_code = 0;
   DigestContext ctx;
 
   if (!image)
     return VERIFY_FIRMWARE_INVALID_IMAGE;
@@ skipping 57 matching lines @@
                               image->firmware_len,
                               image->firmware_sign_algorithm);
   if (!RSAVerify(firmware_sign_key, image->firmware_signature,
                  signature_size, image->firmware_sign_algorithm,
                  firmware_digest)) {
     error_code = VERIFY_FIRMWARE_SIGNATURE_FAILED;
     goto verify_failure;
   }
 
 verify_failure:
+  RSAPublicKeyFree(firmware_sign_key);
   Free(firmware_digest);
   Free(preamble_digest);
   Free(header_digest);
   return error_code;
 }
 
 const char* VerifyFirmwareErrorString(int error) {
   return kVerifyFirmwareErrors[error];
 }
 
@@ skipping 39 matching lines @@
   if (!(firmware_signature = SignatureBuf(image->firmware_data,
                                           image->firmware_len,
                                           signing_key_file,
                                           image->firmware_sign_algorithm)))
     return 0;
   image->firmware_signature = (uint8_t*) Malloc(signature_len);
   Memcpy(image->firmware_signature, firmware_signature, signature_len);
   Free(firmware_signature);
   return 1;
 }