Attachment 695973 Details for Bug 909325 – Patch for RESOURCE_LEAK-CWE-772 bug #1

[patch] Patch for RESOURCE_LEAK-CWE-772 bug #1

0002-RESOURCE_LEAK-CWE-772.patch (text/plain), 5.85 KB, created by Tomáš Hozza on 2013-02-11 07:25:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomáš Hozza

Created: 2013-02-11 07:25:52 UTC

Size: 5.85 KB

patch

obsolete

>From 93a36eb8d32b0cbe3034e3742b128eb81934875c Mon Sep 17 00:00:00 2001
>From: Tomas Hozza <thozza@redhat.com>
>Date: Fri, 8 Feb 2013 15:19:34 +0100
>Subject: [PATCH 2/4] RESOURCE_LEAK (CWE-772)
>
>Coverity output:
>bsd-finger-0.17/finger/finger.c:293: cond_false: Condition "setlocale(6,
>"") != NULL", taking false branch
>bsd-finger-0.17/finger/finger.c:294: if_end: End of if statement
>bsd-finger-0.17/finger/finger.c:296: alloc_fn: Storage is returned from
>allocation function "calloc(size_t, size_t)".
>bsd-finger-0.17/finger/finger.c:296: var_assign: Assigning: "used" =
>storage returned from "calloc(argc, 4UL)".
>bsd-finger-0.17/finger/finger.c:297: cond_false: Condition "!used",
>taking false branch
>bsd-finger-0.17/finger/finger.c:300: if_end: End of if statement
>bsd-finger-0.17/finger/finger.c:303: cond_true: Condition "i < argc",
>taking true branch
>bsd-finger-0.17/finger/finger.c:304: cond_true: Condition
>"!__coverity_strchr(argv[i], 64)", taking true branch
>bsd-finger-0.17/finger/finger.c:306: continue: Continuing loop
>bsd-finger-0.17/finger/finger.c:313: loop: Looping back
>bsd-finger-0.17/finger/finger.c:303: cond_true: Condition "i < argc",
>taking true branch
>bsd-finger-0.17/finger/finger.c:304: cond_true: Condition
>"!__coverity_strchr(argv[i], 64)", taking true branch
>bsd-finger-0.17/finger/finger.c:306: continue: Continuing loop
>bsd-finger-0.17/finger/finger.c:313: loop: Looping back
>bsd-finger-0.17/finger/finger.c:303: cond_false: Condition "i < argc",
>taking false branch
>bsd-finger-0.17/finger/finger.c:313: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:316: cond_true: Condition "dolocal",
>taking true branch
>bsd-finger-0.17/finger/finger.c:316: noescape: Resource "used" is not
>freed or pointed-to in function "do_local(int, char **, int *)".
>bsd-finger-0.17/finger/finger.c:251:51: noescape: "do_local(int, char
>**, int *)" does not free or save its pointer parameter "used".
>bsd-finger-0.17/finger/finger.c:319: cond_false: Condition "pn", taking
>false branch
>bsd-finger-0.17/finger/finger.c:323: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:325: cond_true: Condition "entries ==
>0", taking true branch
>bsd-finger-0.17/finger/finger.c:326: leaked_storage: Variable "used"
>going out of scope leaks the storage it points to.
>
>bsd-finger-0.17/finger/finger.c:293: cond_false: Condition "setlocale(6,
>"") != NULL", taking false branch
>bsd-finger-0.17/finger/finger.c:294: if_end: End of if statement
>bsd-finger-0.17/finger/finger.c:296: alloc_fn: Storage is returned from
>allocation function "calloc(size_t, size_t)".
>bsd-finger-0.17/finger/finger.c:296: var_assign: Assigning: "used" =
>storage returned from "calloc(argc, 4UL)".
>bsd-finger-0.17/finger/finger.c:297: cond_false: Condition "!used",
>taking false branch
>bsd-finger-0.17/finger/finger.c:300: if_end: End of if statement
>bsd-finger-0.17/finger/finger.c:303: cond_true: Condition "i < argc",
>taking true branch
>bsd-finger-0.17/finger/finger.c:304: cond_true: Condition
>"!__coverity_strchr(argv[i], 64)", taking true branch
>bsd-finger-0.17/finger/finger.c:306: continue: Continuing loop
>bsd-finger-0.17/finger/finger.c:313: loop: Looping back
>bsd-finger-0.17/finger/finger.c:303: cond_true: Condition "i < argc",
>taking true branch
>bsd-finger-0.17/finger/finger.c:304: cond_true: Condition
>"!__coverity_strchr(argv[i], 64)", taking true branch
>bsd-finger-0.17/finger/finger.c:306: continue: Continuing loop
>bsd-finger-0.17/finger/finger.c:313: loop: Looping back
>bsd-finger-0.17/finger/finger.c:303: cond_false: Condition "i < argc",
>taking false branch
>bsd-finger-0.17/finger/finger.c:313: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:316: cond_true: Condition "dolocal",
>taking true branch
>bsd-finger-0.17/finger/finger.c:316: noescape: Resource "used" is not
>freed or pointed-to in function "do_local(int, char **, int *)".
>bsd-finger-0.17/finger/finger.c:251:51: noescape: "do_local(int, char
>**, int *)" does not free or save its pointer parameter "used".
>bsd-finger-0.17/finger/finger.c:319: cond_true: Condition "pn", taking
>true branch
>bsd-finger-0.17/finger/finger.c:321: cond_false: Condition "pn->next",
>taking false branch
>bsd-finger-0.17/finger/finger.c:321: cond_true: Condition "entries",
>taking true branch
>bsd-finger-0.17/finger/finger.c:323: loop: Jumping back to the beginning
>of the loop
>bsd-finger-0.17/finger/finger.c:319: loop_begin: Jumped back to
>beginning of loop
>bsd-finger-0.17/finger/finger.c:319: cond_false: Condition "pn", taking
>false branch
>bsd-finger-0.17/finger/finger.c:323: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:325: cond_false: Condition "entries ==
>0", taking false branch
>bsd-finger-0.17/finger/finger.c:326: if_end: End of if statement
>bsd-finger-0.17/finger/finger.c:339: cond_false: Condition "(uptr =
>getutent()) != NULL", taking false branch
>bsd-finger-0.17/finger/finger.c:351: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:352: cond_true: Condition "pn != NULL",
>taking true branch
>bsd-finger-0.17/finger/finger.c:354: loop: Jumping back to the beginning
>of the loop
>bsd-finger-0.17/finger/finger.c:352: loop_begin: Jumped back to
>beginning of loop
>bsd-finger-0.17/finger/finger.c:352: cond_false: Condition "pn != NULL",
>taking false branch
>bsd-finger-0.17/finger/finger.c:354: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:356: leaked_storage: Variable "used"
>going out of scope leaks the storage it points to.
>
>Signed-off-by: Tomas Hozza <thozza@redhat.com>
>---
> finger/finger.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
>diff --git a/finger/finger.c b/finger/finger.c
>index ebf7309..6653e82 100644
>--- a/finger/finger.c
>+++ b/finger/finger.c
>@@ -323,7 +323,10 @@ userlist(int argc, char *argv[])
> 	}
> 
> 	if (entries == 0)
>+	{
>+		free(used);
> 		return;
>+	}
> 
> 	/*
> 	 * Scan thru the list of users currently logged in, saving
>@@ -353,4 +356,5 @@ userlist(int argc, char *argv[])
> 		enter_lastlog(pn);
> 	}
> 	endutent();
>+	free(used);
> }
>-- 
>1.8.1.2
>

Actions: View | Diff

Attachments on bug 909325: 695130 | 695972 | 695973 | 695974 | 695975