Memory leak in a loop in scan_mem function

While reviewing static analysis reports on some CheriBSD ports, I came across this code:

        char *query_value;
        asprintf(&query_value, "(\"0x%lx\", \"0x%lx\", \"%s\", %d, %d, %d, %d)", 
                kivp->kve_start,
                kivp->kve_end,
                mmap_path,
                compart_id,
                kivp->kve_protection,
                kivp->kve_flags,
                kivp->kve_type);

        if (i == 0) {
                        // CSA warning below: Allocator sizeof operand mismatch
            insert_vm_query_values = (char*)malloc(sizeof(query_value)); 
            assert(insert_vm_query_values != NULL);

            insert_vm_query_values = strdup(query_value);
        } else {
            char *temp;
            asprintf(&temp, "%s,%s", 
                insert_vm_query_values,
                query_value);
            insert_vm_query_values = strdup(temp);
            free(temp);
        }
        free(query_value);

I don't have much context of what is going on here, but this looks like a memory leak in a loop to me: insert_vm_query_values is overwritten (both in i==0 and else branches) without freeing it's previous value. It's probably a good idea to rewrite this bit of code anyway with fewer string copies.

CTSRD-CHERI / chericat

Memory leak in a loop in scan_mem function #44