Bug 1896804

I've run coverity on Mirek's official rebase of 11.2.0. After applying the patch Jonathan gave me 

https://github.com/vmware/open-vm-tools/tree/devel, commit e18e67f727d0354b08a55b685178fd05f542c6da

and discarding the thus far known false positives we now have the list below of 4 defects to be addressed. 

It looks like the last 2 are false positives. I did not check the first 2.

Thanks,

Cathy

Error: RESOURCE_LEAK (CWE-772):
open-vm-tools-11.2.0-16938113/lib/hgfsServer/hgfsServer.c:5938: alloc_fn: Storage is returned from allocation function "UtilSafeCalloc0".
open-vm-tools-11.2.0-16938113/lib/hgfsServer/hgfsServer.c:5938: var_assign: Assigning: "entry" = storage returned from "UtilSafeCalloc0(1UL, 16UL)".
open-vm-tools-11.2.0-16938113/lib/hgfsServer/hgfsServer.c:5941: noescape: Resource "entry" is not freed or pointed-to in "HgfsCache_Put".
open-vm-tools-11.2.0-16938113/lib/hgfsServer/hgfsServer.c:5976: leaked_storage: Variable "entry" going out of scope leaks the storage it points to.
# 5974|      *bufOut = myBufOut;
# 5975|   
# 5976|->    return HGFS_NAME_STATUS_COMPLETE;
# 5977|   
# 5978|   error:

Error: RESOURCE_LEAK (CWE-772):
open-vm-tools-11.2.0-16938113/lib/hgfsServer/hgfsServer.c:8504: alloc_fn: Storage is returned from allocation function "UtilSafeCalloc0".
open-vm-tools-11.2.0-16938113/lib/hgfsServer/hgfsServer.c:8504: var_assign: Assigning: "entry" = storage returned from "UtilSafeCalloc0(1UL, 184UL)".
open-vm-tools-11.2.0-16938113/lib/hgfsServer/hgfsServer.c:8507: noescape: Resource "entry" is not freed or pointed-to in "HgfsCache_Put".
open-vm-tools-11.2.0-16938113/lib/hgfsServer/hgfsServer.c:8558: leaked_storage: Variable "entry" going out of scope leaks the storage it points to.
# 8556|   
# 8557|      HgfsServerCompleteRequest(status, replyPayloadSize, input);
# 8558|-> }
# 8559|   
# 8560|   


Error: RESOURCE_LEAK (CWE-772):
open-vm-tools-11.2.0-16938113/vgauth/lib/proto.c:1235: alloc_arg: "VGAuth_CommReadData" allocates memory that is stored into "rawReply".
open-vm-tools-11.2.0-16938113/vgauth/lib/proto.c:1239: leaked_storage: Variable "rawReply" going out of scope leaks the storage it points to.
# 1237|            err = VGAUTH_E_COMM;
# 1238|            Warning("%s: EOF on datastream when trying to parse\n", __FUNCTION__);
# 1239|->          goto abort;
# 1240|         }
# 1241|         if (VGAUTH_E_OK != err) {

Error: RESOURCE_LEAK (CWE-772):
open-vm-tools-11.2.0-16938113/vgauth/serviceImpl/proto.c:1115: alloc_arg: "ServiceNetworkReadData" allocates memory that is stored into "data".
open-vm-tools-11.2.0-16938113/vgauth/serviceImpl/proto.c:1178: leaked_storage: Variable "data" going out of scope leaks the storage it points to.
# 1176|      }
# 1177|   
# 1178|->    return err;
# 1179|   }
# 1180|

Hi Cathy,

Yes, you're right that the last two are false positives.  The first two are as well.

Explanations below.

Jonathan

>Error: RESOURCE_LEAK (CWE-772):
>open-vm-tools-11.2.0-16938113/lib/hgfsServer/hgfsServer.c:5938: alloc_fn: Storage is returned from allocation function "UtilSafeCalloc0".
>open-vm-tools-11.2.0-16938113/lib/hgfsServer/hgfsServer.c:5938: var_assign: Assigning: "entry" = storage returned from "UtilSafeCalloc0(1UL, 16UL)".
>open-vm-tools-11.2.0-16938113/lib/hgfsServer/hgfsServer.c:5941: noescape: Resource "entry" is not freed or pointed-to in "HgfsCache_Put".
>open-vm-tools-11.2.0-16938113/lib/hgfsServer/hgfsServer.c:5976: leaked_storage: Variable "entry" going out of scope leaks the storage it points to.
># 5974|      *bufOut = myBufOut;
># 5975|   
># 5976|->    return HGFS_NAME_STATUS_COMPLETE;
># 5977|   
># 5978|   error:

False positive.  Contrary to the Coverity analysis, "entry" is pointed-to in HgfsCache_Put.


>Error: RESOURCE_LEAK (CWE-772):
>open-vm-tools-11.2.0-16938113/lib/hgfsServer/hgfsServer.c:8504: alloc_fn: Storage is returned from allocation function "UtilSafeCalloc0".
>open-vm-tools-11.2.0-16938113/lib/hgfsServer/hgfsServer.c:8504: var_assign: Assigning: "entry" = storage returned from "UtilSafeCalloc0(1UL, 184UL)".
>open-vm-tools-11.2.0-16938113/lib/hgfsServer/hgfsServer.c:8507: noescape: Resource "entry" is not freed or pointed-to in "HgfsCache_Put".
>open-vm-tools-11.2.0-16938113/lib/hgfsServer/hgfsServer.c:8558: leaked_storage: Variable "entry" going out of scope leaks the storage it points to.
># 8556|   
># 8557|      HgfsServerCompleteRequest(status, replyPayloadSize, input);
># 8558|-> }
># 8559|   
># 8560|   

False positive.  Same as previous: Contrary to the Coverity analysis, "entry" is pointed-to in HgfsCache_Put.


>Error: RESOURCE_LEAK (CWE-772):
>open-vm-tools-11.2.0-16938113/vgauth/lib/proto.c:1235: alloc_arg: "VGAuth_CommReadData" allocates memory that is stored into "rawReply".
>open-vm-tools-11.2.0-16938113/vgauth/lib/proto.c:1239: leaked_storage: Variable "rawReply" going out of scope leaks the storage it points to.
># 1237|            err = VGAUTH_E_COMM;
># 1238|            Warning("%s: EOF on datastream when trying to parse\n", __FUNCTION__);
># 1239|->          goto abort;
># 1240|         }
># 1241|         if (VGAUTH_E_OK != err) {

False positive. VGAuthCommReadData passes back a non-NULL value in rawReply if and only if its return value is VGAUTH_E_OK and the value of len it passes back is non-zero.  In that case, the storage rawReply points to is freed by the g_free call immediately after the call to g_markup_parse_context_parse. 


>Error: RESOURCE_LEAK (CWE-772):
>open-vm-tools-11.2.0-16938113/vgauth/serviceImpl/proto.c:1115: alloc_arg: "ServiceNetworkReadData" allocates memory that is stored into "data".
>open-vm-tools-11.2.0-16938113/vgauth/serviceImpl/proto.c:1178: leaked_storage: Variable "data" going out of scope leaks the storage it points to.
># 1176|      }
># 1177|   
># 1178|->    return err;
># 1179|   }
># 1180|

False positive.  Somewhat similar to previous: ServiceNetworkReadData passes back a non-NULL value in data if and only if it returns VGAUTH_E_OK and conn->eof is FALSE.  In that case, the storage data points to is freed by the g_free call that immediately follows the call to g_markup_parse_context_parse.

(In reply to jsaks from comment #2)

Great!

OK this BZ will remain open as a vehicle to introduce the patch set to our 11.2.0 repo. https://github.com/vmware/open-vm-tools/tree/devel, commit e18e67f727d0354b08a55b685178fd05f542c6da

Thanks,

Cathy

Have completed the auto regression test for open-vm-tools-11.2.0-2.el8, all test cases passed, no regression issue found, add tested flag.

After run regression test on RHEL-8.4.0-20201203.n.0, all open-vm-tools related cases passed, no new issue found.
so change bug status to verified.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (open-vm-tools bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2021:1753