Attachment 695974 Details for Bug 909325 – Patch for RESOURCE_LEAK-CWE-772 bug #2

[patch] Patch for RESOURCE_LEAK-CWE-772 bug #2

0003-RESOURCE_LEAK-CWE-772.patch (text/plain), 9.09 KB, created by Tomáš Hozza on 2013-02-11 07:26:13 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomáš Hozza

Created: 2013-02-11 07:26:13 UTC

Size: 9.09 KB

patch

obsolete

>From bf805902875147e582402fa736022c10edb163bc Mon Sep 17 00:00:00 2001
>From: Tomas Hozza <thozza@redhat.com>
>Date: Fri, 8 Feb 2013 15:41:05 +0100
>Subject: [PATCH 3/4] RESOURCE_LEAK (CWE-772)
>
>Coverity output:
>bsd-finger-0.17/finger/sprint.c:60: alloc_fn: Storage is returned from
>allocation function "sort(void)".
>bsd-finger-0.17/finger/sprint.c:142:2: alloc_fn: Storage is returned
>from allocation function "malloc(size_t)".
>bsd-finger-0.17/finger/sprint.c:142:2: var_assign: Assigning: "list" =
>"malloc((u_int)(entries * 8UL))".
>bsd-finger-0.17/finger/sprint.c:142:2: cond_false: Condition "!(list =
>(PERSON **)malloc((u_int)(entries * 8UL /* sizeof (PERSON *) */)))",
>taking false branch
>bsd-finger-0.17/finger/sprint.c:145:2: if_end: End of if statement
>bsd-finger-0.17/finger/sprint.c:146:7: var_assign: Assigning: "lp" =
>"list".
>bsd-finger-0.17/finger/sprint.c:146:2: cond_true: Condition "pn !=
>NULL", taking true branch
>bsd-finger-0.17/finger/sprint.c:147:3: loop: Jumping back to the
>beginning of the loop
>bsd-finger-0.17/finger/sprint.c:146:2: loop_begin: Jumped back to
>beginning of loop
>bsd-finger-0.17/finger/sprint.c:146:2: cond_false: Condition "pn !=
>NULL", taking false branch
>bsd-finger-0.17/finger/sprint.c:147:3: loop_end: Reached end of loop
>bsd-finger-0.17/finger/sprint.c:148:2: noescape: Resource "list" is not
>freed or pointed-to in function "qsort(void *, size_t, size_t,
>__compar_fn_t)".
>bsd-finger-0.17/finger/sprint.c:149:2: return_alloc: Returning allocated
>memory "list".
>bsd-finger-0.17/finger/sprint.c:60: var_assign: Assigning: "list" =
>storage returned from "sort()".
>bsd-finger-0.17/finger/sprint.c:76: cond_true: Condition "cnt <
>entries", taking true branch
>bsd-finger-0.17/finger/sprint.c:79: cond_true: Condition "pn->name",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:80: cond_true: Condition "l > maxlname",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:81: cond_true: Condition "pn->realname",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:82: cond_true: Condition "l > maxrname",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:83: loop: Jumping back to the beginning
>of the loop
>bsd-finger-0.17/finger/sprint.c:76: loop_begin: Jumped back to beginning
>of loop
>bsd-finger-0.17/finger/sprint.c:76: cond_true: Condition "cnt <
>entries", taking true branch
>bsd-finger-0.17/finger/sprint.c:79: cond_true: Condition "pn->name",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:80: cond_true: Condition "l > maxlname",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:81: cond_true: Condition "pn->realname",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:82: cond_true: Condition "l > maxrname",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:83: loop: Jumping back to the beginning
>of the loop
>bsd-finger-0.17/finger/sprint.c:76: loop_begin: Jumped back to beginning
>of loop
>bsd-finger-0.17/finger/sprint.c:76: cond_true: Condition "cnt <
>entries", taking true branch
>bsd-finger-0.17/finger/sprint.c:79: cond_true: Condition "pn->name",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:80: cond_true: Condition "l > maxlname",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:81: cond_true: Condition "pn->realname",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:82: cond_false: Condition "l >
>maxrname", taking false branch
>bsd-finger-0.17/finger/sprint.c:82: if_end: End of if statement
>bsd-finger-0.17/finger/sprint.c:83: loop: Jumping back to the beginning
>of the loop
>bsd-finger-0.17/finger/sprint.c:76: loop_begin: Jumped back to beginning
>of loop
>bsd-finger-0.17/finger/sprint.c:76: cond_false: Condition "cnt <
>entries", taking false branch
>bsd-finger-0.17/finger/sprint.c:83: loop_end: Reached end of loop
>bsd-finger-0.17/finger/sprint.c:86: cond_true: Condition "maxlname +
>maxrname > space", taking true branch
>bsd-finger-0.17/finger/sprint.c:89: cond_true: Condition "maxlname +
>maxrname < space - 2", taking true branch
>bsd-finger-0.17/finger/sprint.c:93: cond_true: Condition "cnt <
>entries", taking true branch
>bsd-finger-0.17/finger/sprint.c:95: cond_true: Condition "w != NULL",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:96: cond_true: Condition "pn->realname",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:99: cond_true: Condition "!w->loginat",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:101: goto: Jumping to label "office"
>bsd-finger-0.17/finger/sprint.c:120: label: Reached label "office"
>bsd-finger-0.17/finger/sprint.c:121: cond_true: Condition "pn->office",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:122: if_fallthrough: Falling through to
>end of if statement
>bsd-finger-0.17/finger/sprint.c:124: if_end: End of if statement
>bsd-finger-0.17/finger/sprint.c:125: cond_true: Condition
>"pn->officephone", taking true branch
>bsd-finger-0.17/finger/sprint.c:126: if_fallthrough: Falling through to
>end of if statement
>bsd-finger-0.17/finger/sprint.c:129: if_end: End of if statement
>bsd-finger-0.17/finger/sprint.c:131: cond_true: Condition "w->host[0] !=
>0", taking true branch
>bsd-finger-0.17/finger/sprint.c:134: loop: Jumping back to the beginning
>of the loop
>bsd-finger-0.17/finger/sprint.c:95: loop_begin: Jumped back to beginning
>of loop
>bsd-finger-0.17/finger/sprint.c:95: cond_false: Condition "w != NULL",
>taking false branch
>bsd-finger-0.17/finger/sprint.c:134: loop_end: Reached end of loop
>bsd-finger-0.17/finger/sprint.c:135: loop: Jumping back to the beginning
>of the loop
>bsd-finger-0.17/finger/sprint.c:93: loop_begin: Jumped back to beginning
>of loop
>bsd-finger-0.17/finger/sprint.c:93: cond_true: Condition "cnt <
>entries", taking true branch
>bsd-finger-0.17/finger/sprint.c:95: cond_true: Condition "w != NULL",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:96: cond_true: Condition "pn->realname",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:99: cond_true: Condition "!w->loginat",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:101: goto: Jumping to label "office"
>bsd-finger-0.17/finger/sprint.c:120: label: Reached label "office"
>bsd-finger-0.17/finger/sprint.c:121: cond_true: Condition "pn->office",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:122: if_fallthrough: Falling through to
>end of if statement
>bsd-finger-0.17/finger/sprint.c:124: if_end: End of if statement
>bsd-finger-0.17/finger/sprint.c:125: cond_true: Condition
>"pn->officephone", taking true branch
>bsd-finger-0.17/finger/sprint.c:126: if_fallthrough: Falling through to
>end of if statement
>bsd-finger-0.17/finger/sprint.c:129: if_end: End of if statement
>bsd-finger-0.17/finger/sprint.c:131: cond_true: Condition "w->host[0] !=
>0", taking true branch
>bsd-finger-0.17/finger/sprint.c:134: loop: Jumping back to the beginning
>of the loop
>bsd-finger-0.17/finger/sprint.c:95: loop_begin: Jumped back to beginning
>of loop
>bsd-finger-0.17/finger/sprint.c:95: cond_false: Condition "w != NULL",
>taking false branch
>bsd-finger-0.17/finger/sprint.c:134: loop_end: Reached end of loop
>bsd-finger-0.17/finger/sprint.c:135: loop: Jumping back to the beginning
>of the loop
>bsd-finger-0.17/finger/sprint.c:93: loop_begin: Jumped back to beginning
>of loop
>bsd-finger-0.17/finger/sprint.c:93: cond_true: Condition "cnt <
>entries", taking true branch
>bsd-finger-0.17/finger/sprint.c:95: cond_true: Condition "w != NULL",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:96: cond_true: Condition "pn->realname",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:99: cond_true: Condition "!w->loginat",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:101: goto: Jumping to label "office"
>bsd-finger-0.17/finger/sprint.c:120: label: Reached label "office"
>bsd-finger-0.17/finger/sprint.c:121: cond_true: Condition "pn->office",
>taking true branch
>bsd-finger-0.17/finger/sprint.c:122: if_fallthrough: Falling through to
>end of if statement
>bsd-finger-0.17/finger/sprint.c:124: if_end: End of if statement
>bsd-finger-0.17/finger/sprint.c:125: cond_true: Condition
>"pn->officephone", taking true branch
>bsd-finger-0.17/finger/sprint.c:126: if_fallthrough: Falling through to
>end of if statement
>bsd-finger-0.17/finger/sprint.c:129: if_end: End of if statement
>bsd-finger-0.17/finger/sprint.c:131: cond_true: Condition "w->host[0] !=
>0", taking true branch
>bsd-finger-0.17/finger/sprint.c:134: loop: Jumping back to the beginning
>of the loop
>bsd-finger-0.17/finger/sprint.c:95: loop_begin: Jumped back to beginning
>of loop
>bsd-finger-0.17/finger/sprint.c:95: cond_false: Condition "w != NULL",
>taking false branch
>bsd-finger-0.17/finger/sprint.c:134: loop_end: Reached end of loop
>bsd-finger-0.17/finger/sprint.c:135: loop: Jumping back to the beginning
>of the loop
>bsd-finger-0.17/finger/sprint.c:93: loop_begin: Jumped back to beginning
>of loop
>bsd-finger-0.17/finger/sprint.c:93: cond_false: Condition "cnt <
>entries", taking false branch
>bsd-finger-0.17/finger/sprint.c:135: loop_end: Reached end of loop
>bsd-finger-0.17/finger/sprint.c:136: leaked_storage: Variable "list"
>going out of scope leaks the storage it points to.
>
>Signed-off-by: Tomas Hozza <thozza@redhat.com>
>---
> finger/sprint.c | 1 +
> 1 file changed, 1 insertion(+)
>
>diff --git a/finger/sprint.c b/finger/sprint.c
>index 0aaa82f..c66584f 100644
>--- a/finger/sprint.c
>+++ b/finger/sprint.c
>@@ -133,6 +133,7 @@ office:
> 			xputc('\n');
> 		}
> 	}
>+	free(list);
> }
> 
> static PERSON **sort(void) {
>-- 
>1.8.1.2
>

Actions: View | Diff

Attachments on bug 909325: 695130 | 695972 | 695973 | 695974 | 695975