seL4 / seL4_libs

No-assurance libraries for rapid-prototyping of seL4 apps.
https://docs.sel4.systems
Other
52 stars 62 forks source link

libsel4utils: load_segment memory leak bug #35

Closed cloudsec closed 3 years ago

cloudsec commented 3 years ago

hello: i found a memory leak bug in libsel4utils/src/elf.c

static int load_segment(vspace_t *loadee_vspace, vspace_t *loader_vspace,
                        vka_t *loadee_vka, vka_t *loader_vka,
                        const char *src, size_t file_size, int num_regions,
                        sel4utils_elf_region_t regions[num_regions], int region_index)
{
    seL4_CPtr loader_slot;
    cspacepath_t loader_frame_cap;

    error = vka_cspace_alloc(loader_vka, &loader_slot);   // [1]
    while (pos < segment_size && error == seL4_NoError) {
        reservation_t reservation;
        if (loadee_vaddr < region.reservation_vstart) {
            if ((region_index - 1) < 0) {
                ZF_LOGE("Invalid regions: bad elf file.");
                return 1;                                                            // [2]
            }
}

if [2] happned, it not free the prev alloc memory, and then it's memory will be leaked. i think the correct way is invoke vka_cspace_free() before return.

kent-mcleod commented 3 years ago

Thanks for reporting this.

Fixed by https://github.com/seL4/seL4_libs/pull/36