bus1 / dbus-broker

Linux D-Bus Message Broker
https://github.com/bus1/dbus-broker/wiki
Apache License 2.0
667 stars 78 forks source link

Coverity reports 5 double-frees #294

Closed evverx closed 2 years ago

evverx commented 2 years ago

I'm not sure if it's a false positive or not but those warnings weren't there 5 days ago and popped up today when I sent the latest version of dbroker to Coverity. The full report can be found at https://scan.coverity.com/projects/dbus-broker but those warnings generally look like

** CID 271788: Memory - corruptions (USE_AFTER_FREE)

________________________________________________________________________________________________________
*** CID 271788: Memory - corruptions (USE_AFTER_FREE)
/src/bus/driver.c: 464 in driver_send_error()
458 r = c_dvar_end_write(&var, &data, &n_data);
459 if (r)
460 return error_origin(r);
461
462 r = message_new_outgoing(&message, data, n_data);
463 if (r)
     CID 271788: Memory - corruptions (USE_AFTER_FREE)
     Calling "c_dvar_deinit" frees pointer "var.data" which has already been freed.
464 return error_fold(r);
465 data = NULL;
466
467 r = driver_send_unicast(receiver, message);
468 if (r)
469 return error_trace(r);

** CID 271787: Memory - corruptions (USE_AFTER_FREE)
dvdhrm commented 2 years ago

Yeah, I saw those and I cannot make sense of them. c_dvar_end_write() returns the data pointer and resets the internal pointer to NULL, unconditionally. So the situation the report talks about c_dvar_deinit(), the pointer is already cleared and it cannot have any effect. I am really unsure what this was triggered by.

evverx commented 2 years ago

My guess would be that https://github.com/c-util/c-dvar/commit/383d803686b9c3cb8eba31a8a3bd3e5e82b84593 somehow triggered it. It seems to be the only commit where c_dvar_end_write was changed as far as I can see.

c_dvar_write_data was changed there apparently so it shouldn't have triggered that either.

evverx commented 2 years ago

I'll go ahead and close it because it appears to be a false positive. Thanks!