Skip to content

Commit 2a41f00

Browse files
XV02XV02
committed
update: Memory leaks in strdup and asprintf functions and derivates (Partial)
1 parent b31172c commit 2a41f00

10 files changed

Lines changed: 106 additions & 15 deletions

File tree

‎src/libltfs/fs.c‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,11 @@ static char* generate_hash_key_name(const char *src_str, int *rc)
9393
free(uchar_name);
9494
#else
9595
key_name = arch_strdup(src_str);
96-
*rc = 0;
96+
if (!key_name) {
97+
*rc = -LTFS_NO_MEMORY;
98+
} else {
99+
*rc = 0;
100+
}
97101
#endif
98102

99103
return key_name;

‎src/libltfs/index_criteria.c‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -309,23 +309,43 @@ int index_criteria_parse_name(const char *criteria, size_t len, struct index_cri
309309
*delim = '\0';
310310
rule_ptr->percent_encode = fs_is_percent_encode_required(rule);
311311
rule_ptr->name = arch_strdup(rule);
312+
if (!rule_ptr->name) {
313+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
314+
arch_safe_free(rulebuf);
315+
return -LTFS_NO_MEMORY;
316+
}
312317
rule_ptr++;
313318
rule = delim+1;
314319
} else if (*delim == '/') {
315320
*delim = '\0';
316321
rule_ptr->percent_encode = fs_is_percent_encode_required(rule);
317322
rule_ptr->name = arch_strdup(rule);
323+
if (!rule_ptr->name) {
324+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
325+
arch_safe_free(rulebuf);
326+
return -LTFS_NO_MEMORY;
327+
}
318328
rule_ptr++;
319329
} else if (*(delim+1) == '\0') {
320330
rule_ptr->percent_encode = fs_is_percent_encode_required(rule);
321331
rule_ptr->name = arch_strdup(rule);
332+
if (!rule_ptr->name) {
333+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
334+
arch_safe_free(rulebuf);
335+
return -LTFS_NO_MEMORY;
336+
}
322337
rule_ptr++;
323338
}
324339
}
325340

326341
if (ic->glob_patterns == rule_ptr) {
327342
rule_ptr->percent_encode = fs_is_percent_encode_required(rule);
328343
rule_ptr->name = arch_strdup(rule);
344+
if (!rule_ptr->name) {
345+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
346+
arch_safe_free(rulebuf);
347+
return -LTFS_NO_MEMORY;
348+
}
329349
}
330350

331351
/* Validate rules */

‎src/libltfs/ltfs_internal.c‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1298,6 +1298,11 @@ int ltfs_split_symlink(struct ltfs_volume *vol)
12981298

12991299
/* check lost_and_found directory and make if it doesn't exist */
13001300
int pathsize = asprintf( &lfdir, "/%s", LTFS_LOSTANDFOUND_DIR );
1301+
if (pathsize < 0) {
1302+
ltfsmsg(LTFS_ERR, 10001E, "_ltfs_recover_symlink: lfdir");
1303+
return -LTFS_NO_MEMORY;
1304+
}
1305+
13011306
ret = fs_path_lookup(lfdir, 0, &workd, vol->index);
13021307
if ( ret==-LTFS_NO_DENTRY ) {
13031308
ret = ltfs_fsops_create( lfdir, true, false, false, &workd, vol);
@@ -1313,6 +1318,11 @@ int ltfs_split_symlink(struct ltfs_volume *vol)
13131318
}
13141319
ret = ltfs_fsops_close( workd, true, true, use_iosche, vol);
13151320
path=arch_strdup(lfdir);
1321+
if (!path) {
1322+
ltfsmsg(LTFS_ERR, 10001E, "_ltfs_recover_symlink: path");
1323+
free(lfdir);
1324+
return -LTFS_NO_MEMORY;
1325+
}
13161326

13171327
/* loop for conflicted files */
13181328
for( i=0; i<(vol->index->symerr_count); i++ ){

‎src/libltfs/tape.c‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1915,13 +1915,27 @@ int tape_get_media_pool_info(struct ltfs_volume *vol, char **media_name, char **
19151915
if (is_add_info) {
19161916
if (add_start !=0) {
19171917
name = strndup(vol->t_attr->media_pool, add_start);
1918+
if (!name) {
1919+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
1920+
return -LTFS_NO_MEMORY;
1921+
}
19181922
}
19191923
info = arch_strdup(&(vol->t_attr->media_pool[add_start+1]));
1924+
if (!info) {
1925+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
1926+
if (name)
1927+
free(name);
1928+
return -LTFS_NO_MEMORY;
1929+
}
19201930
len = strlen(info);
19211931
info[len-1] = '\0';
19221932
}
19231933
else {
19241934
name = arch_strdup(vol->t_attr->media_pool);
1935+
if (!name) {
1936+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
1937+
return -LTFS_NO_MEMORY;
1938+
}
19251939
}
19261940

19271941
if (name)

‎src/libltfs/xml_writer_libltfs.c‎

Lines changed: 21 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -784,20 +784,30 @@ int xml_schema_to_file(const char *filename, const char *creator,
784784
return -1;
785785
}
786786

787-
if (reason)
788-
asprintf(&alt_creator, "%s - %s", creator , reason);
789-
else
787+
if (reason) {
788+
ret = asprintf(&alt_creator, "%s - %s", creator , reason);
789+
if (ret < 0) {
790+
ltfsmsg(LTFS_ERR, 10001E, "xml_schema_to_file: alt_creator");
791+
xmlFreeTextWriter(writer);
792+
return -LTFS_NO_MEMORY;
793+
}
794+
} else {
790795
alt_creator = arch_strdup(creator);
796+
if (!alt_creator) {
797+
ltfsmsg(LTFS_ERR, 10001E, "xml_schema_to_file: alt_creator");
798+
xmlFreeTextWriter(writer);
799+
return -LTFS_NO_MEMORY;
800+
}
801+
}
791802

792-
if (alt_creator) {
793-
ret = _xml_write_schema(writer, alt_creator, idx);
794-
if (ret < 0)
795-
ltfsmsg(LTFS_ERR, 17052E, ret, filename);
796-
else
797-
_commit_offset_caches(filename, idx);
803+
ret = _xml_write_schema(writer, alt_creator, idx);
804+
if (ret < 0)
805+
ltfsmsg(LTFS_ERR, 17052E, ret, filename);
806+
else
807+
_commit_offset_caches(filename, idx);
798808

799-
xmlFreeTextWriter(writer);
800-
free(alt_creator);
809+
xmlFreeTextWriter(writer);
810+
free(alt_creator);
801811
} else {
802812
ltfsmsg(LTFS_ERR, 10001E, "xml_schema_to_file: alt creator string");
803813
xmlFreeTextWriter(writer);

‎src/tape_drivers/freebsd/cam/cam_tc.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2403,6 +2403,7 @@ int camtape_set_default(void *device)
24032403
*/
24042404
if (ioctl(softc->fd_sa, MTIOCPARAMSET, &sili_param) == -1) {
24052405
msg = strdup("Error returned from MTIOCPARAMSET ioctl to set the SILI bit");
2406+
/* If strdup fails, msg is NULL; camtape_process_errors handles NULL gracefully */
24062407
rc = -EDEV_DRIVER_ERROR;
24072408
camtape_process_errors(device, rc, msg, "set default parameter", true);
24082409
goto bailout;
@@ -2437,6 +2438,7 @@ int camtape_set_default(void *device)
24372438
eot_model = 1;
24382439
if (ioctl(softc->fd_sa, MTIOCSETEOTMODEL, &eot_model) == -1) {
24392440
msg = strdup("Error returned from MTIOCSETEOTMODEL ioctl to set the EOT model to 1FM");
2441+
/* If strdup fails, msg is NULL; camtape_process_errors handles NULL gracefully */
24402442
rc = -EDEV_DRIVER_ERROR;
24412443
camtape_process_errors(device, rc, msg, "set default parameter", true);
24422444
goto bailout;
@@ -3946,6 +3948,7 @@ int camtape_set_lbp(void *device, bool enable)
39463948
entry = mt_status_entry_find(&mtinfo, tmpname);
39473949
if (entry == NULL) {
39483950
msg = strdup("Cannot find sa(4) protection.protection_supported parameter");
3951+
/* If strdup fails, msg is NULL; camtape_process_errors handles NULL gracefully */
39493952
rc = -EDEV_INVALID_ARG;
39503953
camtape_process_errors(device, rc, msg, "get lbp", true);
39513954
goto bailout;
@@ -3965,6 +3968,7 @@ int camtape_set_lbp(void *device, bool enable)
39653968
prot_entry = mt_status_entry_find(&mtinfo, MT_PROTECTION_NAME);
39663969
if (prot_entry == NULL) {
39673970
msg = strdup("Cannot find sa(4) protection node!");
3971+
/* If strdup fails, msg is NULL; camtape_process_errors handles NULL gracefully */
39683972
rc = -EDEV_INVALID_ARG;
39693973
camtape_process_errors(device, rc, msg, "get lbp", true);
39703974
goto bailout;
@@ -3998,6 +4002,7 @@ int camtape_set_lbp(void *device, bool enable)
39984002
entry = mt_entry_find(prot_entry, __DECONST(char *, protect_list[i].name));
39994003
if (entry == NULL) {
40004004
msg = strdup("Cannot find all protection information entries");
4005+
/* If strdup fails, msg is NULL; camtape_process_errors handles NULL gracefully */
40014006
rc = -EDEV_INVALID_ARG;
40024007
camtape_process_errors(device, rc, msg, "get lbp", true);
40034008
goto bailout;
@@ -4020,6 +4025,7 @@ int camtape_set_lbp(void *device, bool enable)
40204025
snprintf(tmpstr, sizeof(tmpstr), "Error returned from MTIOCSETLIST ioctl to set "
40214026
"protection parameters: %s", strerror(errno));
40224027
msg = strdup(tmpstr);
4028+
/* If strdup fails, msg is NULL; camtape_process_errors handles NULL gracefully */
40234029
rc = -errno;
40244030
camtape_process_errors(device, rc, msg, "get lbp", true);
40254031
goto bailout;

‎src/tape_drivers/generic/file/filedebug_tc.c‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -502,8 +502,13 @@ int filedebug_open(const char *name, void **handle)
502502
}
503503

504504
/* Run on file mode */
505-
if (devname == NULL)
505+
if (devname == NULL) {
506506
devname = arch_strdup(name);
507+
if (!devname) {
508+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
509+
return -EDEV_NO_MEMORY;
510+
}
511+
}
507512
ltfsmsg(LTFS_INFO, 30001I, devname);
508513

509514
arch_open(&(state->fd), devname, O_RDWR | O_BINARY, SHARE_FLAG_DENYWR, PERMISSION_READWRITE);
@@ -2744,8 +2749,9 @@ int filedebug_get_device_list(struct tc_drive_info *buf, int count)
27442749

27452750
if (buf && deventries < count) {
27462751
tmp = arch_strdup(entry->d_name);
2747-
if (! *tmp) {
2752+
if (! tmp) {
27482753
ltfsmsg(LTFS_ERR, 10001E, "filedebug_get_device_list");
2754+
closedir(dp);
27492755
return -ENOMEM;
27502756
}
27512757

‎src/tape_drivers/linux/lin_tape/lin_tape_ibmtape.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1018,6 +1018,10 @@ int lin_tape_ibmtape_open(const char *devname, void **handle)
10181018
if (!ret) {
10191019
/* Specified file is existed. Use it as a device file name */
10201020
devfile = strdup(devname);
1021+
if (!devfile) {
1022+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
1023+
return -LTFS_NO_MEMORY;
1024+
}
10211025
} else {
10221026
/* Search device by serial number (Assume devname has a drive serial) */
10231027
devs = lin_tape_ibmtape_get_device_list(NULL, 0);

‎src/utils/ltfsck.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -304,6 +304,10 @@ int main(int argc, char **argv)
304304
break;
305305
if (c == 'i') {
306306
config_file = arch_strdup(optarg);
307+
if (!config_file) {
308+
ltfsmsg(LTFS_ERR, 10001E, "ltfsck: config_file");
309+
return LTFSCK_OPERATIONAL_ERROR;
310+
}
307311
break;
308312
}
309313
}

‎src/utils/mkltfs.c‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,10 +159,19 @@ void show_usage(char *appname, struct config_file *config, bool full)
159159
if (default_backend && plugin_load(&backend, "tape", default_backend, config) == 0) {
160160
devname = arch_strdup(ltfs_default_device_name(backend.ops));
161161
plugin_unload(&backend);
162+
if (!devname) {
163+
ltfsmsg(LTFS_ERR, 10001E, "show_usage: devname");
164+
devname = strdup("<devname>"); /* Fallback for help text */
165+
}
162166
}
163167

164-
if (! devname)
168+
if (! devname) {
165169
devname = arch_strdup("<devname>");
170+
if (!devname) {
171+
ltfsmsg(LTFS_ERR, 10001E, "show_usage: devname fallback");
172+
devname = strdup("<devname>"); /* Last resort for help text */
173+
}
174+
}
166175

167176
fprintf(stderr, "\n");
168177
ltfsresult(15400I, appname); /* Usage: %s <options> */
@@ -283,6 +292,10 @@ int main(int argc, char **argv)
283292
break;
284293
if (c == 'i') {
285294
config_file = arch_strdup(optarg);
295+
if (!config_file) {
296+
ltfsmsg(LTFS_ERR, 10001E, "mkltfs: config_file");
297+
return MKLTFS_OPERATIONAL_ERROR;
298+
}
286299
break;
287300
}
288301
}

0 commit comments

Comments
 (0)