Skip to content

Commit 75a17a7

Browse files
XV02XV02
authored
update: Memory leaks in stdup and asprintf (#588)
1 parent b3e3355 commit 75a17a7

18 files changed

Lines changed: 412 additions & 103 deletions

File tree

‎configure.ac‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,10 @@ AC_USE_SYSTEM_EXTENSIONS
4949
AC_PROG_CC_C99
5050
AM_PROG_CC_C_O
5151
AM_PROG_AR
52-
AC_PROG_LIBTOOL
52+
dnl
53+
dnl Initialize libtool - use LT_INIT for libtool 2.x, AC_PROG_LIBTOOL for 1.x
54+
dnl
55+
m4_ifdef([LT_INIT], [LT_INIT], [AC_PROG_LIBTOOL])
5356

5457
dnl
5558
dnl Detecting OS

‎src/libltfs/arch/filename_handling.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,9 @@ void update_platform_safe_name(struct dentry* dentry, bool handle_invalid_char,
131131
}
132132
#else
133133
dentry->platform_safe_name = arch_strdup(dentry->name.name);
134+
if (!dentry->platform_safe_name) {
135+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
136+
}
134137
#endif
135138
}
136139

‎src/libltfs/index_criteria.c‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -309,23 +309,43 @@ int index_criteria_parse_name(const char *criteria, size_t len, struct index_cri
309309
*delim = '\0';
310310
rule_ptr->percent_encode = fs_is_percent_encode_required(rule);
311311
rule_ptr->name = arch_strdup(rule);
312+
if (!rule_ptr->name) {
313+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
314+
arch_safe_free(rulebuf);
315+
return -LTFS_NO_MEMORY;
316+
}
312317
rule_ptr++;
313318
rule = delim+1;
314319
} else if (*delim == '/') {
315320
*delim = '\0';
316321
rule_ptr->percent_encode = fs_is_percent_encode_required(rule);
317322
rule_ptr->name = arch_strdup(rule);
323+
if (!rule_ptr->name) {
324+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
325+
arch_safe_free(rulebuf);
326+
return -LTFS_NO_MEMORY;
327+
}
318328
rule_ptr++;
319329
} else if (*(delim+1) == '\0') {
320330
rule_ptr->percent_encode = fs_is_percent_encode_required(rule);
321331
rule_ptr->name = arch_strdup(rule);
332+
if (!rule_ptr->name) {
333+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
334+
arch_safe_free(rulebuf);
335+
return -LTFS_NO_MEMORY;
336+
}
322337
rule_ptr++;
323338
}
324339
}
325340

326341
if (ic->glob_patterns == rule_ptr) {
327342
rule_ptr->percent_encode = fs_is_percent_encode_required(rule);
328343
rule_ptr->name = arch_strdup(rule);
344+
if (!rule_ptr->name) {
345+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
346+
arch_safe_free(rulebuf);
347+
return -LTFS_NO_MEMORY;
348+
}
329349
}
330350

331351
/* Validate rules */

‎src/libltfs/ltfs_fsops.c‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1913,6 +1913,10 @@ int ltfs_fsops_symlink_path(const char* to, const char* from, ltfs_file_id *id,
19131913
id->uid = d->uid;
19141914
id->ino = d->ino;
19151915
d->target.name = arch_strdup(to);
1916+
if (!d->target.name) {
1917+
ltfs_fsops_close(d, true, true, use_iosche, vol);
1918+
return -LTFS_NO_MEMORY;
1919+
}
19161920
d->target.percent_encode = fs_is_percent_encode_required(to);
19171921
d->isslink = true;
19181922

@@ -2063,7 +2067,7 @@ int ltfs_fsops_target_absolute_path(const char* link, const char* target, char*
20632067
len -= strlen(temp_buf); /* length of "/aaa" */
20642068
} else if (strcmp(token, "." )) { /* have directory name */
20652069
work_buf[len] = '/'; /* put '/ 'as "/aaa/" */
2066-
arch_strncpy(work_buf+len+1, token, work_buf_len, strlen(token) ); /* "/aaa/ccc\0" */
2070+
arch_strncpy(work_buf+len+1, token, work_buf_len, strlen(token)); /* "/aaa/ccc\0" */
20672071
len = strlen(work_buf);
20682072
}
20692073
token = next_token;

‎src/libltfs/ltfs_internal.c‎

Lines changed: 27 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1289,7 +1289,7 @@ int ltfs_split_symlink(struct ltfs_volume *vol)
12891289
size_t i, size;
12901290
struct dentry *d, *workd;
12911291
int ret=0;
1292-
char *name, *lfdir, *path, *tok, *next_tok;
1292+
char *name, *lfdir, *path, *new_path, *tok, *next_tok;
12931293
bool basedir=true, use_iosche=false;
12941294
char value[32];
12951295
ltfs_file_id id;
@@ -1298,6 +1298,11 @@ int ltfs_split_symlink(struct ltfs_volume *vol)
12981298

12991299
/* check lost_and_found directory and make if it doesn't exist */
13001300
int pathsize = asprintf( &lfdir, "/%s", LTFS_LOSTANDFOUND_DIR );
1301+
if (pathsize < 0) {
1302+
ltfsmsg(LTFS_ERR, 10001E, "_ltfs_recover_symlink: lfdir");
1303+
return -LTFS_NO_MEMORY;
1304+
}
1305+
13011306
ret = fs_path_lookup(lfdir, 0, &workd, vol->index);
13021307
if ( ret==-LTFS_NO_DENTRY ) {
13031308
ret = ltfs_fsops_create( lfdir, true, false, false, &workd, vol);
@@ -1313,6 +1318,11 @@ int ltfs_split_symlink(struct ltfs_volume *vol)
13131318
}
13141319
ret = ltfs_fsops_close( workd, true, true, use_iosche, vol);
13151320
path=arch_strdup(lfdir);
1321+
if (!path) {
1322+
ltfsmsg(LTFS_ERR, 10001E, "_ltfs_recover_symlink: path");
1323+
free(lfdir);
1324+
return -LTFS_NO_MEMORY;
1325+
}
13161326

13171327
/* loop for conflicted files */
13181328
for( i=0; i<(vol->index->symerr_count); i++ ){
@@ -1327,7 +1337,14 @@ int ltfs_split_symlink(struct ltfs_volume *vol)
13271337

13281338
/* check directory path and make if it doesn't exist */
13291339
while( next_tok ){
1330-
asprintf( &path, "%s/%s", path, tok );
1340+
ret = asprintf(&new_path, "%s/%s", path, tok);
1341+
if (ret < 0) {
1342+
ltfsmsg(LTFS_ERR, 10001E, "_ltfs_recover_symlink: path");
1343+
ret = -LTFS_NO_MEMORY;
1344+
goto err_out_func;
1345+
}
1346+
free(path);
1347+
path = new_path;
13311348
if ( basedir ) {
13321349
ret = fs_path_lookup(path, 0, &workd, vol->index);
13331350
if ( ret==-LTFS_NO_DENTRY )
@@ -1347,7 +1364,14 @@ int ltfs_split_symlink(struct ltfs_volume *vol)
13471364
next_tok = arch_strtok( NULL, "/", contextVal);
13481365
}
13491366
/* Make filename with path in lost_and_found */
1350-
asprintf( &path, "%s/%s", path, tok);
1367+
ret = asprintf(&new_path, "%s/%s", path, tok);
1368+
if (ret < 0) {
1369+
ltfsmsg(LTFS_ERR, 10001E, "_ltfs_recover_symlink: path");
1370+
ret = -LTFS_NO_MEMORY;
1371+
goto err_out_func;
1372+
}
1373+
free(path);
1374+
path = new_path;
13511375
ret = fs_path_lookup(path, 0, &workd, vol->index);
13521376
if ( ret == 0 ) {
13531377
/* delete same name old symlink */

‎src/libltfs/ltfslogging.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,9 @@ void ltfsprintf_unload_plugin(void *handle);
162162
* only to stderr.
163163
* @param print_id Print the message prefix LTFSnnnnn ?
164164
* @param level Log level of this message, must be one of the ltfs_log_levels (LTFS_ERROR, etc.).
165+
* @param msg_out Optional pointer to receive a dynamically allocated copy of the formatted message.
166+
* Pass NULL if not needed. If non-NULL, the caller must check if *msg_out is NULL
167+
* (indicating memory allocation failure) and must free the returned string when done.
165168
* @param id Unique ID of this error.
166169
* @return 0 if a message was printed or a negative value on error.
167170
*/

‎src/libltfs/ltfssnmp.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,12 @@ int read_trap_def_file(char *deffile)
123123
return -LTFS_NO_MEMORY;
124124
}
125125
entry->id = arch_strdup(tok);
126+
if (! entry->id) {
127+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
128+
free(entry);
129+
fclose(fp);
130+
return -LTFS_NO_MEMORY;
131+
}
126132
TAILQ_INSERT_TAIL(&trap_entries, entry, list);
127133
}
128134
}

‎src/libltfs/tape.c‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1916,13 +1916,27 @@ int tape_get_media_pool_info(struct ltfs_volume *vol, char **media_name, char **
19161916
if (is_add_info) {
19171917
if (add_start !=0) {
19181918
name = strndup(vol->t_attr->media_pool, add_start);
1919+
if (!name) {
1920+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
1921+
return -LTFS_NO_MEMORY;
1922+
}
19191923
}
19201924
info = arch_strdup(&(vol->t_attr->media_pool[add_start+1]));
1925+
if (!info) {
1926+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
1927+
if (name)
1928+
free(name);
1929+
return -LTFS_NO_MEMORY;
1930+
}
19211931
len = strlen(info);
19221932
info[len-1] = '\0';
19231933
}
19241934
else {
19251935
name = arch_strdup(vol->t_attr->media_pool);
1936+
if (!name) {
1937+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
1938+
return -LTFS_NO_MEMORY;
1939+
}
19261940
}
19271941

19281942
if (name)
@@ -3062,7 +3076,9 @@ void set_tape_attribute(struct ltfs_volume *vol, struct tape_attr *t_attr)
30623076
* @param set attribute type
30633077
* @return 0 positive : success, negative : cannot set value to Cartridge Memory
30643078
*/
3065-
int tape_set_attribute_to_cm(struct device_data *dev, struct tape_attr *t_attr, int type)
3079+
int tape_set_attribute_to_cm(struct device_data* dev,
3080+
struct tape_attr* t_attr,
3081+
int type)
30663082
{
30673083
int ret;
30683084
int attr_size;

‎src/libltfs/xattr.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -664,7 +664,12 @@ static int _xattr_get_virtual(struct dentry *d, char *buf, size_t buf_size, cons
664664
default:
665665
break;
666666
}
667-
asprintf(&val, "0x%08x", (uint32_t)(vol->device->write_protected | lock));
667+
ret = asprintf(&val, "0x%08x", (uint32_t)(vol->device->write_protected | lock));
668+
if (ret < 0) {
669+
ltfsmsg(LTFS_ERR, 10001E, name);
670+
val = NULL;
671+
ret = -LTFS_NO_MEMORY;
672+
}
668673
} else {
669674
val = NULL;
670675
ret = -LTFS_CART_NOT_MOUNTED;

‎src/libltfs/xml_reader_libltfs.c‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,11 @@ static int decode_entry_name(char **new_name, const char *name)
155155

156156
*new_name = arch_strdup(tmp_name);
157157
free(tmp_name);
158+
159+
if (!*new_name) {
160+
ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
161+
return -LTFS_NO_MEMORY;
162+
}
158163

159164
return 0;
160165
}
@@ -187,8 +192,10 @@ static int _xml_parse_nametype(xmlTextReaderPtr reader, struct ltfs_name *n, boo
187192
}
188193

189194
if (n->percent_encode) {
190-
decode_entry_name(&decoded_name, encoded_name);
195+
ret = decode_entry_name(&decoded_name, encoded_name);
191196
free(encoded_name);
197+
if (ret < 0)
198+
return ret;
192199
} else {
193200
decoded_name = encoded_name;
194201
}
@@ -241,8 +248,10 @@ static int _xml_parse_nametype_allow_zero_length(xmlTextReaderPtr reader, struct
241248
}
242249

243250
if (n->percent_encode) {
244-
decode_entry_name(&decoded_name, encoded_name);
251+
ret = decode_entry_name(&decoded_name, encoded_name);
245252
free(encoded_name);
253+
if (ret < 0)
254+
return ret;
246255
} else {
247256
decoded_name = encoded_name;
248257
}

0 commit comments

Comments
 (0)