diff mbox series

[BlueZ,resend,8/9] sdp: Fix memory leak in sdp_data_alloc*()

Message ID 20240702142436.833138-9-hadess@hadess.net (mailing list archive)
State Accepted
Commit 5dcc52a486f27867bdb685a39e10fadc9e6afa6f
Headers show
Series Fix a number of static analysis issues #4 | expand

Checks

Context Check Description
tedd_an/pre-ci_am success Success
tedd_an/CheckPatch success CheckPatch PASS
tedd_an/GitLint fail WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search 7: B1 Line exceeds max length (100>80): "bluez-5.76/lib/sdp.c:542:4: alloc_fn: Storage is returned from allocation function "sdp_data_alloc"." 8: B1 Line exceeds max length (115>80): "bluez-5.76/lib/sdp.c:542:4: var_assign: Assigning: "data" = storage returned from "sdp_data_alloc(dtd, values[i])"." 13: B1 Line exceeds max length (109>80): "bluez-5.76/lib/sdp.c:545:4: leaked_storage: Variable "seq" going out of scope leaks the storage it points to." 15: B3 Line contains hard tab characters (\t): "544| if (!data)" 16: B3 Line contains hard tab characters (\t): "545|-> return NULL;" 18: B3 Line contains hard tab characters (\t): "547| if (curr)"
tedd_an/IncrementalBuild success Incremental Build PASS

Commit Message

Bastien Nocera July 2, 2024, 2:23 p.m. UTC 
Make sure to free already allocated memory if we run out of memory
before the end of the loop.

Error: RESOURCE_LEAK (CWE-772): [#def8] [important]
bluez-5.76/lib/sdp.c:542:4: alloc_fn: Storage is returned from allocation function "sdp_data_alloc".
bluez-5.76/lib/sdp.c:542:4: var_assign: Assigning: "data" = storage returned from "sdp_data_alloc(dtd, values[i])".
bluez-5.76/lib/sdp.c:550:4: var_assign: Assigning: "seq" = "data".
bluez-5.76/lib/sdp.c:552:3: var_assign: Assigning: "curr" = "data".
bluez-5.76/lib/sdp.c:553:2: out_of_scope: Variable "data" goes out of scope.
bluez-5.76/lib/sdp.c:552:3: overwrite_var: Overwriting "curr" in "curr = data".
bluez-5.76/lib/sdp.c:545:4: leaked_storage: Variable "seq" going out of scope leaks the storage it points to.
543|
544|		if (!data)
545|->			return NULL;
546|
547|		if (curr)
---
 lib/sdp.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/lib/sdp.c b/lib/sdp.c
index 2e66505b21b8..b87951b007a3 100644
--- a/lib/sdp.c
+++ b/lib/sdp.c
@@ -513,8 +513,10 @@  sdp_data_t *sdp_seq_alloc_with_length(void **dtds, void **values, int *length,
 		else
 			data = sdp_data_alloc_with_length(dtd, values[i], length[i]);
 
-		if (!data)
+		if (!data) {
+			sdp_data_free(seq);
 			return NULL;
+		}
 
 		if (curr)
 			curr->next = data;
@@ -541,8 +543,10 @@  sdp_data_t *sdp_seq_alloc(void **dtds, void **values, int len)
 		else
 			data = sdp_data_alloc(dtd, values[i]);
 
-		if (!data)
+		if (!data) {
+			sdp_data_free(seq);
 			return NULL;
+		}
 
 		if (curr)
 			curr->next = data;