Bug 712080 - NULL free
Summary: NULL free
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: abrt
Version: 6.1
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Jiri Moskovcak
QA Contact: BaseOS QE - Apps
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-06-09 12:55 UTC by Michal Luscon
Modified: 2015-02-01 22:54 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-06-09 13:28:41 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Michal Luscon 2011-06-09 12:55:50 UTC
/src/Daemon/RPM.cpp:91 - If variable pgpsig is NULL, NULL pointer will be freed after goto jump (line #107).

Version-Release number of selected component (if applicable):
1.1.16-3

Additional info: This defect is not present in current supported version of
abrt package.

Comment 2 Jiri Moskovcak 2011-06-09 13:28:41 UTC
From the free() man page:

If ptr is NULL, no operation is performed. -> NOTABUG

Comment 3 Ondrej Vasik 2011-06-09 14:25:54 UTC
I think Michal misunderstood the Coverity report:

Error: FORWARD_NULL (Priority: medium) 
abrt-1.1.16/src/Daemon/RPM.cpp:91: var_compare_op: Comparing "pgpsig" to null implies that "pgpsig" might be null.
abrt-1.1.16/src/Daemon/RPM.cpp:98: var_deref_model: Passing null variable "pgpsig" to function "strstr", which dereferences it. (The dereference is assumed on the basis of the 'nonnull' parameter attribute.)

In fact, there is really an issue in rpm_to_c.patch (added by patch).

pgpsig could be NULL ... but check on abrt-1.1.16/src/Daemon/RPM.cpp:91 has && condition with errmsg . If even the errmsg is NULL, you will pass null variable to strstr function on line 98 (char *pgpsig_tmp = strstr(pgpsig, " Key ID ");)

So the patch should be improved, but as you are probably going to rebase abrt in RHEL-6 anyway, I guess we could keep this bugzilla closed.


Note You need to log in before you can comment on or make changes to this bug.