Bug 712080

Summary:	NULL free
Product:	Red Hat Enterprise Linux 6	Reporter:	Michal Luscon <mluscon>
Component:	abrt	Assignee:	Jiri Moskovcak <jmoskovc>
Status:	CLOSED NOTABUG	QA Contact:	BaseOS QE - Apps <qe-baseos-apps>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.1	CC:	ahecox, dfediuck, dvlasenk, gavin, kklic, npajkovs, ovasik
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-06-09 13:28:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Michal Luscon 2011-06-09 12:55:50 UTC

/src/Daemon/RPM.cpp:91 - If variable pgpsig is NULL, NULL pointer will be freed after goto jump (line #107).

Version-Release number of selected component (if applicable):
1.1.16-3

Additional info: This defect is not present in current supported version of
abrt package.

Comment 2 Jiri Moskovcak 2011-06-09 13:28:41 UTC

From the free() man page:

If ptr is NULL, no operation is performed. -> NOTABUG

Comment 3 Ondrej Vasik 2011-06-09 14:25:54 UTC

I think Michal misunderstood the Coverity report:

Error: FORWARD_NULL (Priority: medium) 
abrt-1.1.16/src/Daemon/RPM.cpp:91: var_compare_op: Comparing "pgpsig" to null implies that "pgpsig" might be null.
abrt-1.1.16/src/Daemon/RPM.cpp:98: var_deref_model: Passing null variable "pgpsig" to function "strstr", which dereferences it. (The dereference is assumed on the basis of the 'nonnull' parameter attribute.)

In fact, there is really an issue in rpm_to_c.patch (added by patch).

pgpsig could be NULL ... but check on abrt-1.1.16/src/Daemon/RPM.cpp:91 has && condition with errmsg . If even the errmsg is NULL, you will pass null variable to strstr function on line 98 (char *pgpsig_tmp = strstr(pgpsig, " Key ID ");)

So the patch should be improved, but as you are probably going to rebase abrt in RHEL-6 anyway, I guess we could keep this bugzilla closed.