unix: fix uv_spawn() NULL pointer deref on ENOMEM

In the cleanup-after-error section of uv_spawn(), check that the pointer is non-NULL - we might end up in said section due to a malloc() failure.
joyent · Oct 2, 2013 · fc3a21f · fc3a21f
1 parent 8c9cbee
commit fc3a21f
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/src/unix/process.c b/src/unix/process.c
@@ -463,11 +463,13 @@ int uv_spawn(uv_loop_t* loop,
 error:
   uv__set_sys_error(process->loop, errno);
 
-  for (i = 0; i < stdio_count; i++) {
-    close(pipes[i][0]);
-    close(pipes[i][1]);
+  if (pipes != NULL) {
+    for (i = 0; i < stdio_count; i++) {
+      close(pipes[i][0]);
+      close(pipes[i][1]);
+    }
+    free(pipes);
   }
-  free(pipes);
 
   return -1;
 }