Bug#941814: libpopt: leaks memory for leftover arguments

[Milan Broz]

Hello,

what's the status of the fix/patch in this bug?

We see many leaks for cryptsetup in valgrind tests if running under Debian
(while other distros apparently do not have this problem) and it seems
all reported problems are with poptGetNextOpt ...

Thanks,
Milan

Bug#941814: libpopt: leaks memory for leftover arguments

[Christian Göttsche]

First look:

Seems like gdisk uses a popt internal argv string after
poptResetContext() [1] and svox frees one [2].


[1] https://sources.debian.org/src/gdisk/1.0.4-3/gptcl.cc/?hl=153#L158
Line 152: get leftover string
Line 153: call popResetContext(), which free's with the patch
Line 158: use this string

[2] 
https://sources.debian.org/src/svox/1.0+git20130326-9/pico/bin/pico2wave.c/?hl=162#L375
Line 160: get leftover string
Line 162: assign to variable text
Line 375: free(text)

Bug#941814: libpopt: leaks memory for leftover arguments

[Michael Jeanson]

found #941814

Regressions were reported in gdisk and svox, I reverted the patch until
more testing can be done.

gdisk/1.0.4-3:
 https://ci.debian.net/data/autopkgtest/testing/amd64/g/gdisk/3216686/log.gz

svox/1.0+git20130326-9:
 https://ci.debian.net/data/autopkgtest/testing/amd64/s/svox/3216687/log.gz

Bug#941814: libpopt: leaks memory for leftover arguments

[Christian Göttsche]

Package: libpopt0
Version: 1.16-12
Severity: important
Affects: logrotate
Tags: patch

The patch 318833-incorrect-handling-of-leftovers-with-poptStuffArgs.patch
introduces a memory leak for leftover arguments.

Previously the content of 'con->leftovers' did not hold own memory, so
it did not need to be freed.
With that patch it does, but it is not cleaned properly.
First there is a typo in line 57 (extra '&'), so the content would
never be freed.
Secondly in 'poptFreeContext()' 'poptResetContext()' is called, which
sets 'con->numLeftovers' to 0.
So the whole loop (line 56-58 in the patch) is not executed.


poptleak.sh
Description: application/shellscript
diff -Nru ../popt_orig/popt-1.16/popt.c ../popt/popt-1.16/popt.c
--- ../popt_orig/popt-1.16/popt.c	2019-10-05 23:40:23.0 +0200
+++ ../popt/popt-1.16/popt.c	2019-10-05 23:44:07.784682313 +0200
@@ -234,6 +234,9 @@
 con->os->nextArg = _free(con->os->nextArg);
 con->os->next = 1;			/* skip argv[0] */
 
+for (i = 0; i < con->numLeftovers; i++) {
+	con->leftovers[i] = _free(con->leftovers[i]);
+}
 con->numLeftovers = 0;
 con->nextLeftover = 0;
 con->restLeftover = 0;
@@ -1651,7 +1654,7 @@
 con->numExecs = 0;
 
 for (i = 0; i < con->numLeftovers; i++) {
-	con->leftovers[i] = _free(>leftovers[i]);
+	con->leftovers[i] = _free(con->leftovers[i]);
 }
 con->leftovers = _free(con->leftovers);