| Message ID | 20180305225820.23610-1-nicolas.iooss@m4x.org (mailing list archive) |
|---|---|
| State | Not Applicable |
| Headers | show |
On 03/05/2018 05:58 PM, Nicolas Iooss wrote: > In sepol_ibendport_key_create(), if sepol_ibendport_alloc_ibdev_name() > fails to allocate tmp_key->ibdev_name, sepol_ibendport_key_free() is > called to free the memory associated with tmp_key, which results in > free() being called on uninitialized tmp_key->ibdev_name. > > This issue is reported by clang's static analyzer with the following > message: > > ibendport_record.c:115:2: warning: 1st function call argument is an > uninitialized value > free(key->ibdev_name); > ^~~~~~~~~~~~~~~~~~~~~ > > Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> > --- > libsepol/src/ibendport_record.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/libsepol/src/ibendport_record.c b/libsepol/src/ibendport_record.c > index 912aeb536fd9..8285a9d6ffcf 100644 > --- a/libsepol/src/ibendport_record.c > +++ b/libsepol/src/ibendport_record.c > @@ -62,8 +62,10 @@ int sepol_ibendport_key_create(sepol_handle_t *handle, > goto omem; > } > > - if (sepol_ibendport_alloc_ibdev_name(handle, &tmp_key->ibdev_name) < 0) > + if (sepol_ibendport_alloc_ibdev_name(handle, &tmp_key->ibdev_name) < 0) { > + tmp_key->ibdev_name = NULL; > goto err; > + } > > strncpy(tmp_key->ibdev_name, ibdev_name, IB_DEVICE_NAME_MAX); > tmp_key->port = port; >
On 03/05/2018 05:58 PM, Nicolas Iooss wrote: > In sepol_ibendport_key_create(), if sepol_ibendport_alloc_ibdev_name() > fails to allocate tmp_key->ibdev_name, sepol_ibendport_key_free() is > called to free the memory associated with tmp_key, which results in > free() being called on uninitialized tmp_key->ibdev_name. > > This issue is reported by clang's static analyzer with the following > message: > > ibendport_record.c:115:2: warning: 1st function call argument is an > uninitialized value > free(key->ibdev_name); > ^~~~~~~~~~~~~~~~~~~~~ > > Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org> > --- > libsepol/src/ibendport_record.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/libsepol/src/ibendport_record.c b/libsepol/src/ibendport_record.c > index 912aeb536fd9..8285a9d6ffcf 100644 > --- a/libsepol/src/ibendport_record.c > +++ b/libsepol/src/ibendport_record.c > @@ -62,8 +62,10 @@ int sepol_ibendport_key_create(sepol_handle_t *handle, > goto omem; > } > > - if (sepol_ibendport_alloc_ibdev_name(handle, &tmp_key->ibdev_name) < 0) > + if (sepol_ibendport_alloc_ibdev_name(handle, &tmp_key->ibdev_name) < 0) { > + tmp_key->ibdev_name = NULL; > goto err; > + } > > strncpy(tmp_key->ibdev_name, ibdev_name, IB_DEVICE_NAME_MAX); > tmp_key->port = port; > It seems to be that a better way to fix this is to modify sepol_ibendport_alloc_ibdev_name(), so that the result of the calloc is assigned to *ibdev_name. That way if the calloc fails, tmp_key->ibdev_name will be set to NULL automatically.
diff --git a/libsepol/src/ibendport_record.c b/libsepol/src/ibendport_record.c index 912aeb536fd9..8285a9d6ffcf 100644 --- a/libsepol/src/ibendport_record.c +++ b/libsepol/src/ibendport_record.c @@ -62,8 +62,10 @@ int sepol_ibendport_key_create(sepol_handle_t *handle, goto omem; } - if (sepol_ibendport_alloc_ibdev_name(handle, &tmp_key->ibdev_name) < 0) + if (sepol_ibendport_alloc_ibdev_name(handle, &tmp_key->ibdev_name) < 0) { + tmp_key->ibdev_name = NULL; goto err; + } strncpy(tmp_key->ibdev_name, ibdev_name, IB_DEVICE_NAME_MAX); tmp_key->port = port;
In sepol_ibendport_key_create(), if sepol_ibendport_alloc_ibdev_name() fails to allocate tmp_key->ibdev_name, sepol_ibendport_key_free() is called to free the memory associated with tmp_key, which results in free() being called on uninitialized tmp_key->ibdev_name. This issue is reported by clang's static analyzer with the following message: ibendport_record.c:115:2: warning: 1st function call argument is an uninitialized value free(key->ibdev_name); ^~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org> --- libsepol/src/ibendport_record.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)