On 03/05/2018 05:58 PM, Nicolas Iooss wrote:
In sepol_ibendport_key_create(), if sepol_ibendport_alloc_ibdev_name()
fails to allocate tmp_key->ibdev_name, sepol_ibendport_key_free() is
called to free the memory associated with tmp_key, which results in
free() being called on uninitialized tmp_key->ibdev_name.

This issue is reported by clang's static analyzer with the following
message:

     ibendport_record.c:115:2: warning: 1st function call argument is an
     uninitialized value
             free(key->ibdev_name);
             ^~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Nicolas Iooss <nicolas.io...@m4x.org>
---
  libsepol/src/ibendport_record.c | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libsepol/src/ibendport_record.c b/libsepol/src/ibendport_record.c
index 912aeb536fd9..8285a9d6ffcf 100644
--- a/libsepol/src/ibendport_record.c
+++ b/libsepol/src/ibendport_record.c
@@ -62,8 +62,10 @@ int sepol_ibendport_key_create(sepol_handle_t *handle,
                goto omem;
        }
- if (sepol_ibendport_alloc_ibdev_name(handle, &tmp_key->ibdev_name) < 0)
+       if (sepol_ibendport_alloc_ibdev_name(handle, &tmp_key->ibdev_name) < 0) 
{
+               tmp_key->ibdev_name = NULL;
                goto err;
+       }
strncpy(tmp_key->ibdev_name, ibdev_name, IB_DEVICE_NAME_MAX);
        tmp_key->port = port;


It seems to be that a better way to fix this is to modify sepol_ibendport_alloc_ibdev_name(), so that the result of the calloc is assigned to *ibdev_name. That way if the calloc fails, tmp_key->ibdev_name will be set to NULL automatically.


--
James Carter <jwca...@tycho.nsa.gov>
National Security Agency

Reply via email to